Dharma

Dharma is typically deployed manually through RDP using weak or leaked credentials.

“Dharma, Phobos, and GlobeImposter commonly target small and mid-sized organizations, often through exposed remote desktop services.”

Some of these criminals were dealing with the penetration effort, using multiple mechanisms to compromise IT networks, including brute force attacks, SQL injections, stolen credentials and phishing emails with malicious attachments.

According to the sample that we encountered, the variant arrives through a phishing email, as seen in Figure 1.

Dharma is typically deployed manually through RDP using weak or leaked credentials.

It then copies itself to the %System% directory using the original filename and creates autorun registry entries under HKLM and HKCU.

“Dharma, Phobos, and GlobeImposter commonly target small and mid-sized organizations, often through exposed remote desktop services.”

Finally, the ransomware will configure itself to automatically start when you login to Windows. This allows it to encrypt new files that are created since it was last executed.

The malware also copies itself into both Start Menu Startup folders.

Dharma is typically deployed manually through RDP using weak or leaked credentials.

Finally, the ransomware will configure itself to automatically start when you login to Windows. This allows it to encrypt new files that are created since it was last executed.

The malware also copies itself into both Start Menu Startup folders.

Dharma uses the RC4 stream cipher to decrypt embedded strings that contain Windows API function names.

When executed, Dharma uses the RC4 stream cipher to decrypt embedded strings that contain Windows API function names. It resolves these function addresses at runtime.

Fileless delivery also adds a further challenge in removing this threat, as it leaves no trace after execution.

First was the execution of a bat file called shadow.bat, which deletes shadow files vssadmin delete shadows /all

Dharma is typically deployed manually through RDP using weak or leaked credentials.

If the Windows version is older than Windows Vista, or if the mutexes already exist, Dharma exits.

It then copies itself to the %System% directory using the original filename and creates autorun registry entries under HKLM and HKCU.

Some of these criminals were dealing with the penetration effort, using multiple mechanisms to compromise IT networks, including brute force attacks, SQL injections, stolen credentials and phishing emails with malicious attachments.

It stops database services such as Firebird and MSSQL, terminates processes including postgres.exe, mysqld.exe, sqlservr.exe, and Outlook.

It should be noted that this ransomware will encrypt mapped network drives and unmapped network shares.

If the Windows version is older than Windows Vista, or if the mutexes already exist, Dharma exits.

Many Dharma intrusions begin when threat actors gain access to a Windows system through Remote Desktop Protocol (RDP).

The first attack that we have record was on 24th May 2019, in this case the infection vector was through RDP attack. This kind of infection vector execute a brute force on credentials

Many of the hospital's records were encrypted due to the attack, and these included files containing patient information such as names, home addresses, dates of birth, social security numbers, driver license numbers, credit card information, phone numbers, and medical data.

Eventually, the loader will connect to “hastebin[.]com” and decode the binary (Crysis) from the command-and-control (C&C) server

It would be unusual for ransomware to encrypt and then exfiltrate information should the malware's purpose be simply to secure a blackmail payment. However, as the threat actor was present on ABH servers and details are thin on the ground, it is possible this data has made its way into the wrong hands.

“Successful data encryption also rose to 56 per cent of attacks” and recovery requires restoring data and systems after ransomware encrypts them.

Before encrypting files, Dharma attempts to stop services and terminate processes that may restrict file access. It stops database services such as Firebird and MSSQL.

vssadmin delete shadows /all /quiet

Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities... killing security software processes or services, modifying / deleting Registry keys or configuration files... Adversaries may also disable updates...