BLACK FRIDAY: 2-for-1 offer NOVEMBER 20 - 26 See details
41
Global rank
73 infographic chevron month
Month rank
63 infographic chevron week
Week rank
0
IOCs

Dharma is advanced ransomware that has been observed in the wild since 2016. It is considered to be the second most profitable RaaS operation by the FBI. The malware targets hospitals and state organizations, encrypts files, and demands a payment to restore access to lost information.

Ransomware
Type
Unknown
Origin
24 August, 2017
First seen
11 September, 2024
Last seen

How to analyze Dharma with ANY.RUN

Type
Unknown
Origin
24 August, 2017
First seen
11 September, 2024
Last seen

IOCs

IP addresses
185.20.187.20
98.4.227.199
81.103.144.77
75.110.250.89
216.201.162.158
47.201.1.210
47.146.169.85
75.137.239.211
80.240.26.178
24.226.137.154
184.98.104.7
216.163.4.91
24.42.14.241
173.245.152.231
72.209.191.27
66.26.160.37
98.219.77.197
47.205.231.60
75.87.161.32
96.37.137.42
Hashes
ae9f39d9e8308951adfa91e0f30ffe9e4280e3488e3a165da00c9f9e02cc9f28
96c4f9e2f50e98a133f6376bdd20427196da52e500b811bdd91edaf4f0f63777
78e5d4d5371a8676a0f622a3c1d14a26d2f3c0f43e5475913f08caa9fb04616f
276727bfacdeba0ba864fd6ccecab5fd0f244576dc503d7cf148a4deb90fc136
3f382ea030ed56543b3a674c9168aa470aa1e88a51fbbe2d0433d9d629692587
6985917d29596b66d9bbc745a13d5577110d9b0408719c5559d23dd59a9e4f0b
b7a4b6a622db4163338ba420e7f4b4b9d3adae82d04ef43f5e9d5995bcb31ee3
687eb545e44d6f71a24a21f0ae2cdd85cde7272b9874f492f38ebe4c9640731b
4b5b11e64fdf9d164ab4a592ecbf99032ae0ac79aecbf68fe6a59deffb8e6ef3
8503dc118230560d5b577550efa6e07d196b585c183d960daf3e30663a95e20a
23651e9b7cdde798baa8a43eed6bc719c9e4cb4adecef349294b405cab1df9e9
94ef44e3f7be172fb47203eb942e4601f1a96cb4bfd37e055fd6cf39b5db49a6
93658ba1f13f3195df776fa469f241189768fd24ddab1bf7c3331f4235dd3406
6f64d864d4cdeaa6062e44e34c0969ebdead56edb22e5a2b61c987ca3400fad4
9236987c5d5ff03115ad1cd94afd680a54f91cd3b775ef874d8f1cb7afc32ad0
085105e613ad37808a8db9a3c2ba5561d5d38d5c5c43b469c93d15f0d64af0c1
245f7a3c993a0ecada1c1f8936ea82e8e48812c5758767e5d91db91324bc303a
a08c192df62e58faf203a10d830a6f0c34f1d843373ce5ca6f4826ed45a36764
273ceba8ef0d7c6946c3054d4f0948febdde794c28b654c9acbef2ebf720fc10
6dccf0e19dbdd6b012b3423523c4ee5d37470cf0b3164c2564a4f332265418c7
Domains
281clara.com
cdpogo.net
dsooneclinicianexpert.com
ketotoken.com
golphysi.com
fisioservice.com
dreamneeds.info
hanferd.com
crazzysex.com
gteesrd.com
eatatnobu.com
bestmedicationstore.com
europartnersplus.com
bayfrontbabyplace.com
gayjeans.com
jicuiquan.net
hannan-football.com
hamptondc.com
buynewcartab.live
aa8520.com
Last Seen at

Recent blog posts

post image
ANY.RUN Now Integrates with Splunk!
watchers 312
comments 0
post image
How to Analyze Malware in ANY.RUN Sandbox: Er...
watchers 357
comments 0
post image
Security Training Lab: Educational Program fo...
watchers 1157
comments 0

What is Dharma ransomware?

Dharma is a ransomware-type malware. A malicious program that encrypted files and demands a ransom to restore information. Dharma, a member of the CrySIS family, has been around since August 2017, targeting organizations such as hospitals. It managed to earn attackers over $25 million in ransom payments.

General description of Dharma ransomware

Dharma is considered to be advanced ransomware that uses powerful encryption. As a new variant of the CrySIS family, it was first spotted in the wild in 2017. It was operated by an unknown cyber gang who managed to remain mostly in the shadows to this day. CrySIS was offered as a RaaS (Ransomware-as-a-Service), meaning that “clients” could use it, if they purchased the ransomware from the attackers. This means that those who purchase the malware carry out the actual attacks rather than original creators.

Threat actors changed the name over to Dharma after decryption keys for CrySIS were leaked in late 2016. That was the first, but not the only time somebody published the decryption keys, but it was the only time attackers renamed the malware and re-branded the product.

Some researchers believe that Dharma is one of the most popular RaaS malware out there right now. The popularity of this ransomware is partly due to the constant updates that attackers have been rolling out throughout the years it was active.

In fact, there were instances where three new versions of the malware were reported during the same week. In addition, Dharma proved to be very adaptive, changing distribution channels as the underground community moved from mass spam emails to more targeted attacks in 2018 and 2019.

Another part that contributed to the popularity of Dharma is its flexibility. Although the ransom amount is usually set to one Bitcoin, it can be customized depending on the victim profile. This means that for smaller organizations that can’t pay this much (mind you, Bitcoin cost almost 20,000 USD in 2017), the payment amount can be lowered.

Although not unique to this malware, this flexibility and customization greatly enhanced its effectiveness. In fact, the FBI named Dharma the second most profitable ransomware operation.

Now, despite all of the above, Dharma has never really been available to the general public. The only places it could be found were inconspicuous underground forums. At least, until recently.

In late 2019, the source code of Dharma was observed being put for sale for 2,000 USD.

This made many researchers worried, as some predicted that putting the source code for sale will result in somebody uploading it to the public internet. If ransomware as advanced as Dharma gets in the hands of a mass audience, we can be up for a lot of trouble.

It should also be noted that in 2019 researchers reported new ransomware called Phobos, which has almost the same code as Dharma. Although some speculated that this could be another rebranding, Dharma samples are still constantly being found about as often as instances of Phobos malware use.

Dharma malware analysis

A video recorded in the ANY.RUN interactive malware hunting service shows how the execution of this ransomware unfolds from the victim’s point of view.

raccoon_process_graph

Figure 1: Displays the execution process of the Dharma ransomware This graph was generated by ANY.RUN.

raccoon_process_graph

Figure 2: Displays the Dharma ransomware ransom note

Dharma ransomware execution process

The execution process of the Dharma ransomware is relatively typical for this type of malware such as WannaCry. After the executable file makes its way into an infected system and runs, the main malicious activity begins. After the start of execution, the ransomware deletes shadow copies. After it encrypts all targeted files, Dharma drops a ransom note on the desktop.

Dharma ransomware distribution

Dharma has been observed using multiple distribution methods, but the following three are the most common.

  • Targeted emails with malicious attachments or links.
  • Use of compromised legitimate software, often antiviruses.
  • Targeted campaigns that abuse the RDP protocol.

Out of the three distribution channels, spam email campaigns are the most straightforward. It is also how threat actors relied on the most during the first years of malware operation, launching widespread campaigns and relying on sheer numbers of potential recipients.

However, as users and organizations become more educated about the dangers of cyberattacks, spam emails lose effectiveness. Dharma operators quickly adapted and restored to the other two methods for payload delivery.

Another method that Dharma is known to use is utilizing real compromised software. For example, some attacks involved targeted email campaigns that contained a download link. What made these attacks stand out is that upon clicking the link, the payload would be downloaded along with a compromised legitimate program. The program then would launch an installer designed to direct the victim's attention while the executable file is running in the background.

Finally, the last common distribution method is through the use of compromised RDP. RDP is a protocol developed by Microsoft used to establish a connection between multiple PCs over a network. It’s a completely legitimate protocol that technicians use to carry out remote technical support, among other uses. However, if a session becomes compromised, it gives hackers the ability to download and execute the malicious file as long as they have access to the remotely connected PC.

Conclusion

Dharma is dangerous ransomware. Since 2017 its popularity has been only growing, and continued use indicates that members of the underground hacking community see it as a reliable option. Given that even the FBI considers Dharma to be one of the most effective malware in its class, it’s no wonder that this malware is in demand.

However, even more, worrying is that despite all the attention that Dharma has been getting over the years, creators of this ransomware managed to evade researchers and evolve the ransomware along the way continually.

Although decryptors do exist for some versions of Dharma, the only reason they could be created is that somebody from the inside leaked master keys. Apart from these instances, little progress has been made to crack the encryption algorithm used by Dharma.

And now, with the source code appearing for sale, we run the risk of it popping up on the global Internet, which can spawn a new, massive wave of Dharma attacks.

Keeping this in mind, researchers should take time to study Dharma behavior to prepare for potential attacks carefully. Thankfully, ANY.RUN provides all the necessary tools to carry out Dharma analysis in a secure online environment.

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Agent Tesla screenshot
Agent Tesla
agenttesla trojan rat stealer
Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
Read More
Amadey screenshot
Amadey
amadey
Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.
Read More
Arkei screenshot
Arkei
arkei stealer
Arkei is a stealer type malware capable of collecting passwords, autosaved forms, cryptocurrency wallet credentials, and files.
Read More
AsyncRAT screenshot
AsyncRAT
asyncrat
AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.
Read More
WarZone screenshot
WarZone
warzone avemaria stealer trojan rat
WarZone RAT is a remote access trojan, which is written in C++ and offered as a malware-as-a-service. It packs a wide range of capabilities, from stealing victims’ files and passwords to capturing desktop activities. WarZone RAT is primarily distributed via phishing emails and receives regular updates from its C2.
Read More