Dharma

MITRE ATT&CK does not currently catalogue Dharma, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.

1. T1059.001 PowerShell Execution

   What they do: dharma executes malicious commands via PowerShell scripts to stage payloads and manipulate system behavior.

   What that means: Adversaries may abuse PowerShell commands and scripts for execution.

2. T1106 Native API Execution

   What they do: dharma leverages native Windows API calls to hide malicious processes and evade detection.

   What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.

3. T1547.001 Registry Run Keys / Startup Folder PersistencePrivilege Escalation

   What they do: dharma modifies registry run keys to ensure malware execution upon system reboot for persistence.

   What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.

4. T1685 Disable or Modify Tools Defense Impairment

   What they do: dharma disables antivirus tools and security software to prevent system recovery and hinder user defenses.

   What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.

5. T1070.004 File Deletion Stealth

   What they do: dharma deletes Volume Shadow Copies and backup files to eliminate recovery options for victims.

   What that means: Adversaries may delete files left behind by the actions of their intrusion activity.

6. T1057 Process Discovery Discovery

   What they do: dharma discovers running processes to identify critical services and isolate targets for disruption.

   What that means: Adversaries may attempt to get information about running processes on a system.

7. T1021.002 SMB/Windows Admin Shares Lateral Movement

   What they do: dharma uses SMB/Windows Admin Shares to propagate payloads across networked victim systems.

   What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

8. T1486 Data Encrypted for Impact Impact

   What they do: dharma encrypts victim files using a custom ransomware algorithm to maximize impact and extortion leverage.

   What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

9. T1489 Service Stop Impact

   What they do: dharma executes kill.bat commands to stop critical services and disrupt operational continuity.

   What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

10. T1490 Inhibit System Recovery Impact

    What they do: dharma calls system recovery commands to inhibit backup restoration and lock down affected infrastructure.

    What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

The note this group leaves on a compromised machine. Click a filename to read it.

All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected]
Write this ID in the title of your message [snip]
In case of no answer in 24 hours write us to theese e-mails: [email protected]
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files.
Free decryption as guarantee
Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 10Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Ransom-note text from RansomLook, licensed CC BY 4.0.