MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1398be5280bdfc67179822e32d2d39e3e36afac05f88f3267cc7a1a63a3bdb68. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dharma

Vendor detections: 4

Intelligence 4 IOCs YARA 2 File information Comments

SHA256 hash:	1398be5280bdfc67179822e32d2d39e3e36afac05f88f3267cc7a1a63a3bdb68
SHA3-384 hash:	cceda2aad1d38039c71338c0c8cb697120429d0487ac7960ba6299786e8a248e6e007342998102d8f363ceeaf2278c1d
SHA1 hash:	f0d841a37159cd1b5c974fad955f97f096587efc
MD5 hash:	056c04012a484b193db9df09f552c692
humanhash:	september-mountain-pluto-autumn
File name:	1398be5280bdfc67179822e32d2d39e3e36afac05f88f3267cc7a1a63a3bdb68
Download:	download sample
Signature	Dharma Create hunting rule
File size:	94'724 bytes
First seen:	2020-06-10 11:31:09 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f86dec4a80961955a89e7ed62046cc0e (94 x Dharma, 1 x Crysis)
ssdeep	1536:mBwl+KXpsqN5vlwWYyhY9S4A/bEg/nGf+XRJBfDUDmd2Z8osGj5azkA0btyDh:Qw+asqN5aW/hLag/oK7BnatawF2
Threatray	14 similar samples on MalwareBazaar
TLSH	E9939E28D521D131F8A250FFCBFA59BDAD644B101307D4D797C01E89AB869E5F932A33
Reporter	JAMESWT_WT
Tags:	Dharma

Intelligence

File Origin

# of uploads :

# of downloads :

2'014

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Win.Trojan.Dharma-6668198-0

Gathering data

Threat name:

Win32.Ransomware.Crysis

Status:

Malicious

First seen:

2020-03-22 02:57:28 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

31 of 31 (100.00%)

Threat level:

5/5

Verdict:

malicious

Result

Malware family:

dharma

Score:

10/10

Tags:

family:dharma persistence ransomware spyware

Link:

https://tria.ge/reports/201109-m8xmdnwj66/

Behaviour

Interacts with shadow copies

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Drops file in Program Files directory

Drops file in System32 directory

Modifies service

Adds Run key to start application

Drops desktop.ini file(s)

Drops startup file

Reads user/profile data of web browsers

Modifies extensions of user files

Deletes shadow copies

Dharma

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Ransomware_Wadhrama Create hunting rule
Author:	Florian Roth
Description:	Detects Wadhrama Ransomware via Imphash
Reference:	Internal Research

Rule name:	win_dharma_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample