MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dharma


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5
SHA3-384 hash: fbbd35904054673f754b17a0ff4372e7d94e376c268bbfd430a91e83ffe13c50522942dc5e6192a11a5793aea630eb2c
SHA1 hash: ab1750df17d1a2ccc992833550eacac199e47a7d
MD5 hash: c8ebe6f4b11dbc59aade73500887c200
humanhash: steak-leopard-mexico-carbon
File name:2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5.bin
Download: download sample
Signature Dharma
Create hunting rule
File size:94'720 bytes
First seen:2020-10-16 16:35:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f86dec4a80961955a89e7ed62046cc0e (94 x Dharma, 1 x Crysis)
ssdeep 1536:mBwl+KXpsqN5vlwWYyhY9S4AHkicUnWkHfwPPRhzvDfYejZ9kw4n:Qw+asqN5aW/hL6SnWkH2Rhz7f7Z9kw4n
Threatray 33 similar samples on MalwareBazaar
TLSH E2939E24D920D035F8A350FFCBF696BDAE644B201307D4EB96C05D99AB864D5FD32623
Reporter Arkbird_SOLG
Tags:Crysis Dharma Ransomware

Intelligence

File Origin
# of uploads :
1
# of downloads :
3'681
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/72189/
Detection(s):
Win.Trojan.Dharma-6668198-0
Create hunting rule

SecuriteInfo.com.Trojan.Encoder.3953.12180.14230.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the system32 directory
Creating a file
Launching cmd.exe command interpreter
Creating a process with a hidden window
Enabling the 'hidden' option for recently created files
Changing a file
Modifying an executable file
Creating a file in the Program Files directory
Creating a file in the Program Files subdirectories
Launching a process
Replacing executable files
Moving a file to the Program Files subdirectory
Launching a service
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Creating a file in the mass storage device
Deleting volume shadow copies
Enabling autorun by creating a file
Infecting executable files
Result
Threat name:
Crysis Wadhrama
Create hunting rule
Detection:
malicious
Classification:
rans.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/493959
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Creates an autostart registry key pointing to binary in C:\Windows
Creates files in the recycle bin to hide itself
Deletes shadow drive data (may be related to ransomware)
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files to the startup folder
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May disable shadow drive data (uses vssadmin)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Writes many files with high entropy
Yara detected Crysis Ransomware
Yara detected Wadhrama Ransomware
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 299430 Sample: rdcg9YAudu.bin Startdate: 16/10/2020 Architecture: WINDOWS Score: 100 40 Malicious sample detected (through community Yara rule) 2->40 42 Antivirus detection for dropped file 2->42 44 Antivirus / Scanner detection for submitted sample 2->44 46 9 other signatures 2->46 7 rdcg9YAudu.exe 1 501 2->7         started        11 OpenWith.exe 26 13 2->11         started        13 rdcg9YAudu.exe 2->13         started        15 rdcg9YAudu.exe 2->15         started        process3 file4 26 C:\Windows\System32\rdcg9YAudu.exe, PE32 7->26 dropped 28 C:\Users\user\AppData\...\rdcg9YAudu.exe, PE32 7->28 dropped 30 edbres00002.jrs.id...protonmail.com].bmd, COM 7->30 dropped 34 367 other files (360 malicious) 7->34 dropped 48 Creates files in the recycle bin to hide itself 7->48 50 Drops PE files to the startup folder 7->50 52 Creates an autostart registry key pointing to binary in C:\Windows 7->52 54 2 other signatures 7->54 17 cmd.exe 1 7->17         started        32 C:\Users\user\AppData\...\thumbcache_idx.db, data 11->32 dropped signatures5 process6 signatures7 36 May disable shadow drive data (uses vssadmin) 17->36 38 Deletes shadow drive data (may be related to ransomware) 17->38 20 conhost.exe 17->20         started        22 vssadmin.exe 1 17->22         started        24 mode.com 1 17->24         started        process8
Detection:
dharma
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5/
Threat name:
Win32.Ransomware.Crysis
Create hunting rule
Status:
Malicious
First seen:
2020-09-23 13:40:04 UTC
AV detection:
28 of 29 (96.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=frehuq5omci5mtyjxt5rxkulip5valu4t7bu7aum5p7ckhm22h2q._file
Verdict:
malicious
Similar samples:
0a40acb8ddbc2ed8f8b703681fadf9fcb2672fdb75d93c150b45c6465cc9b1b4
Dharma
1398be5280bdfc67179822e32d2d39e3e36afac05f88f3267cc7a1a63a3bdb68
Dharma
307077d1a3fd2b53b94d88268e31b0b89b8c0c2ee9dbb46041d3e2395243f1b3
Dharma
4d8ffa30554984f32eabbcb7a99699dd833ea85a8483db8753cc40bde7cee923
Dharma
553532c3bc00e3b85bcbac054bc4f05cb4fffba6f44a17c663dd37732ce1772d
Dharma
6985917d29596b66d9bbc745a13d5577110d9b0408719c5559d23dd59a9e4f0b
Dharma
90c54543aaf085e00879d4fe98a6dfb8148548f374828d50b6e3ac44668138b2
Dharma
9a4e6b6a25332f21e4e15bd5c67ea1613db78bf02fa3cef2eba47f27723f8d58
Dharma
ad14312e134f8b9483b2d701b1470758e8944764ec803252efede6b1c49e9485
Dharma
ea6bafd96818930f83200987d64c970ad03afcae9d69fbde9dd18f2ace154a99
Dharma
+ 23 additional samples on MalwareBazaar
Result
Malware family:
dharma
Create hunting rule
Score:
  10/10
Tags:
ransomware persistence spyware family:dharma
Link:
https://tria.ge/reports/201016-hnxbg3tnqe/
Behaviour
Interacts with shadow copies
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in System32 directory
Modifies service
Adds Run key to start application
Drops desktop.ini file(s)
Drops startup file
Reads user/profile data of web browsers
Modifies extensions of user files
Deletes shadow copies
Dharma
Unpacked files
SH256 hash:
2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5
MD5 hash:
c8ebe6f4b11dbc59aade73500887c200
SHA1 hash:
ab1750df17d1a2ccc992833550eacac199e47a7d
Detections:
win_dharma_auto
Create hunting rule
Link:
https://www.unpac.me/results/2dcbe1b4-3fa3-4e7b-bae7-cddf7834daa6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Filecoder
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2c487a43ae6091d64f09bcfb1baa8b43fb502e9c9fc34f828cebfe251d9ad1f5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Ransomware_Wadhrama
Create hunting rule
Author:Florian Roth
Description:Detects Wadhrama Ransomware via Imphash
Reference:Internal Research
Rule name:win_dharma_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://github.com/StrangerealIntel/DailyIOC/blob/master/2020-10-16/Ran_Crysis_Sep_2020_1.yar
  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/72189/

Comments