March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert –TA866 Leverages WasabiSeed and Screenshotter Malware in Large-Volume Phishing Campaign – Active IOCs
January 22, 2024
Rewterz Threat Alert –Phobos Ransomware – Active IOCs
January 22, 2024
Rewterz Threat Alert –TA866 Leverages WasabiSeed and Screenshotter Malware in Large-Volume Phishing Campaign – Active IOCs
January 22, 2024
Rewterz Threat Alert –Phobos Ransomware – Active IOCs
January 22, 2024
Severity
High
Analysis Summary
Dharma ransomware is a type of malware that encrypts a victim’s files and demands payment in exchange for the decryption key. It is a variant of the CrySIS ransomware family, which was first discovered in 2016. The malware is typically spread through phishing emails, exploiting vulnerabilities in software, or through the use of exploit kits. Once a system is infected, the ransomware will encrypt files and append the “.dharma” or “.wallet” extension to the file name. The malware will then display a ransom note demanding payment in Bitcoin. It’s important to note that paying the ransom does not guarantee the recovery of files, and it is generally advised to not pay the ransom and instead restore from backups or use reputable decryption tools. Additionally, it is important to keep software up to date and to practice safe browsing habits to prevent infections. It’s also important to note that the attackers behind Dharma ransomware have been known to use double extortion tactics, where they not only encrypt files but also steal and threaten to publicly release sensitive information if the ransom is not paid.
Impact
- Data Encryption
Indicators of Compromise
MD5
- f1ddfed51b6e0f8fe72f86d31b2524bc
- 610ad2917ac0a6862c1cb5e10653ae7c
- 0197eb32a39518adbc118ec0559a395c
SHA-256
- 7df581cf04fd1a76a137c0f83b9357686058060bc52115346b8f65ca5533eb6b
- 4914a13fb03bb5113abd0e8ccfdc5c67ad13149d2504902c716fd94b7f5d398a
- 5e75ef02517afd6e8ba6462b19217dc4a5a574abb33d10eb0f2bab49d8d48c22
SHA-1
- 1c985cf60d1081882e512d42847945598fd425d8
- e94847fd8307e0cf9dd1d9f940537d1a0fc5a0c4
- c81f411cb16e5692f7ea92eebb7f4120e4ad4129
Remediation
- Block all threat indicators at your respective controls.
- Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Emails from unknown senders should always be treated with caution.
- Never trust or open ” links and attachments received from unknown sources/senders.
- Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
- Enable antivirus and anti-malware software and update signature definitions on time. Using multi-layered protection is necessary to secure vulnerable assets.