MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dharma


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919
SHA3-384 hash: 867cffc59034933943360ba858422672e9d46e7d8bf22d30cd1d61204cbce5c711d8c24a971f7e76289c8c58fc7efaf9
SHA1 hash: c71c6a6dc811aab2d597a758bd09b2177f317497
MD5 hash: a9a6801356bda621d857929a25919e67
humanhash: salami-shade-friend-salami
File name:084574bf3180c1493c8f1bb5522e80255be673dbeca80b0a37ee487daf8c6919
Download: download sample
Signature Dharma
Create hunting rule
File size:164'352 bytes
First seen:2020-06-16 09:40:47 UTC
Last seen:2020-06-16 10:51:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 3072:Qj4XAessCPAJkomWAFvAlZi9ORDgi0AMi+WV6OzM3JkRZ40xyiGSEoTi9Wa86:QjIApAG2sgMi9sGZkOx4Wy
Threatray 210 similar samples on MalwareBazaar
TLSH DDF3E05CF7CCCA36CE5D567A48B632561274DAEF0483EB572ACC52B588237C8471AC87
Reporter JAMESWT_WT

Intelligence

File Origin
# of uploads :
2
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/10831/
Detection(s):
SecuriteInfo.com.Variant.Razy.679655.26744.8755.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.SmartAssembly
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 13:53:00 UTC
File Type:
PE (.Net Exe)
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0424b503bc1150372d0e31c85f9cef36d0b656a7c0d3f59663e6a468d0d7ba00
Dharma
227d13f9a142cc6f050b7761e6c6e1bae712c4440730ec71c84e5acb274555e3
Dharma
2d0eb35f04745646d8c6eb3d1ab1c3e8bc8c30f1a9dc0ad89ea260e898ed9d4e
Dharma
45e9481702b87e03705d35c12c5a8a3d795d42f91d562cba539999846c729686
Dharma
4ae809a33d01626e77dcfd591902815692405d2fa1f6ae7df13ca248507e4562
Dharma
65ac9daf3070161ac996fb8946632599547f1c9450d7dcd0f8dc1c85b4e8b3b7
Dharma
9a4e6b6a25332f21e4e15bd5c67ea1613db78bf02fa3cef2eba47f27723f8d58
Dharma
b23eb66e588b47a73b393c87467b0b2b0431d9d346368efeaa36a76c7877cd27
Dharma
c855a83b6b0b51c9e9bc1b2676d5644f1c578b87734517ce63820ca33d155707
Dharma
ea6bafd96818930f83200987d64c970ad03afcae9d69fbde9dd18f2ace154a99
Dharma
+ 200 additional samples on MalwareBazaar
Result
Malware family:
dharma
Create hunting rule
Score:
  10/10
Tags:
ransomware family:dharma persistence spyware
Link:
https://tria.ge/reports/200624-75616d9732/
Behaviour
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Suspicious use of AdjustPrivilegeToken
Interacts with shadow copies
Suspicious behavior: EnumeratesProcesses
Drops file in Program Files directory
Modifies service
Drops file in System32 directory
Suspicious use of SetThreadContext
Adds Run entry to start application
Drops desktop.ini file(s)
Reads user/profile data of web browsers
Drops startup file
Deletes shadow copies
Dharma
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Ransomware_Wadhrama
Create hunting rule
Author:Florian Roth
Description:Detects Wadhrama Ransomware via Imphash
Reference:Internal Research
Rule name:win_dharma_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/10831/

Comments