Dharma (まとめ) - TT Malware Log

【目次】

概要
記事
関連情報
- 【関連マルウェア】
- 【関連まとめ記事】

概要

【辞書】

◆Dharma (Malpedia)
https://malpedia.caad.fkie.fraunhofer.de/details/win.dharma

◆Win32/Filecoder.Crysis (ESET)
https://www.virusradar.com/en/Win32_Filecoder.Crysis.P/description

【概要】

■拡張子

追加される拡張子

[メールアドレス].dharma

■身代金の総額 *1

名称	期間	身代金総額
Ryuk	2018/02 ～2019/10	約6100万ドル

【亜種】

◆Phobos (まとめ)
https://malware-log.hatenablog.com/entry/Phobos

◆ROGER (まとめ)
https://malware-log.hatenablog.com/entry/Roger

【攻撃組織】

◆Parinacota (まとめ)
https://malware-log.hatenablog.com/entry/Parinacota

【最新情報】

◆Police arrest hackers behind over 1,800 ransomware attacks (BleepingComputer, 2021/10/29 05:07)
[1,800件以上のランサムウェア攻撃を行ったハッカーを警察が逮捕]
https://www.bleepingcomputer.com/news/security/police-arrest-hackers-behind-over-1-800-ransomware-attacks/
⇒ https://malware-log.hatenablog.com/entry/2021/10/29/000000_6

記事

【ニュース】

■2017年

◆Free decryption tools now available for Dharma ransomware (ITWorld, 2017/03/02)

Someone leaked the decryption keys for the program online

http://www.itworld.com/article/3176591/security/free-decryption-tools-now-available-for-dharma-ransomware.html
⇒ http://malware-log.hatenablog.com/entry/2017/03/02/000000_1

◆KEYS FOR DHARMA RANSOMWARE RELEASED (threatpost, 2017/03/02 11:34)
https://threatpost.com/keys-for-dharma-ransomware-released/124024/
⇒ http://malware-log.hatenablog.com/entry/2017/03/02/000000_1

◆Kaspersky Releases Decryptor for the Dharma Ransomware (BleepingComputer, 2017/03/02)
https://www.bleepingcomputer.com/news/security/kaspersky-releases-decryptor-for-the-dharma-ransomware/
⇒ http://malware-log.hatenablog.com/entry/2017/03/02/000000_1

◆Kaspersky, ESET, Avast release Dharma ransomware decryptors (Healthcare IT News, 2017/03/03 13:27)
http://www.healthcareitnews.com/news/kaspersky-eset-avast-release-dharma-ransomware-decryptors
⇒ http://malware-log.hatenablog.com/entry/2017/03/03/000000_1

◆ランサムウェア「クライシス」の正体の解明と暗号化解除ツール (キヤノンITソリューションズ, 2017/03/23)
https://eset-info.canon-its.jp/malware_info/trend/detail/170323.html
⇒ http://malware-log.hatenablog.com/entry/2017/03/23/000000_9

◆New Arena Crysis Ransomware Variant Released (BleepingComputer, 2017/08/25)
https://www.bleepingcomputer.com/news/security/new-arena-crysis-ransomware-variant-released/
⇒ http://malware-log.hatenablog.com/entry/2017/08/25/000000_4

■2018年

◆New Brrr Dharma Ransomware Variant Released (BleepingComputer, 2018/09/15)
https://www.bleepingcomputer.com/news/security/new-brrr-dharma-ransomware-variant-released/
⇒ http://malware-log.hatenablog.com/entry/2018/09/15/000000_1

◆Security Alert: New Dharma Ransomware Strains Alarmingly Go Undetected By Antivirus Engines (Heimdal, 2018/11/07)

At least four new strains appeared recently . We even discovered one that goes undetected by almost all the antivirus engines on the market.

https://heimdalsecurity.com/blog/security-alert-dharma-ransomware-undetected-antivirus-engines/
⇒ http://malware-log.hatenablog.com/entry/2018/11/07/000000_5

◆Texas hospital becomes victim of Dharma ransomware (ZDNet, 2018/11/19 12:12)
https://www.zdnet.com/article/texas-hospital-becomes-victim-of-ransomware-patient-data-potentially-leaked/
⇒ http://malware-log.hatenablog.com/entry/2018/11/19/000000_6

◆自動化から手作業に回帰？ターゲットを極めて絞ったランサムウェアがトレンド - SophosLab 2019 Threat Report (マイナビニュース, 2018/11/25 14:44)
https://news.mynavi.jp/article/20181125-sophos2019samsam/
⇒ http://malware-log.hatenablog.com/entry/2018/11/25/000000_1

◆特定ユーザーを狙った標的型攻撃が登場、Sophosの2019年版脅威レポート (@IT, 2018/12/26 18:30)
http://www.atmarkit.co.jp/ait/articles/1812/26/news107.html
⇒ http://malware-log.hatenablog.com/entry/2018/12/26/000000

■2019年

◆「Dharmaのコードを大体カット＆ペースト」したPhobosランサムウェア--被害を拡大 (ZDNet, 2019/01/22 10:28)
https://japan.zdnet.com/article/35131580/
⇒ http://malware-log.hatenablog.com/entry/2019/01/22/000000

◆PHOBOS, THE NEW RANSOMWARE OF DHARMA GROUP, INFECTS HUNDREDS OF ORGANIZATIONS (SecurityNewspaper, 2019/01/22)
https://www.securitynewspaper.com/2019/01/22/phobos-the-new-ransomware-of-dharma-group-infects-hundreds-of-organizations/
⇒ http://malware-log.hatenablog.com/entry/2019/01/22/000000

◆高額の身代金要求するランサムウェア。支払われた仮想通貨9割増：2019年Q1 (Coindesk, 2019/04/22 09:00)
https://www.coindeskjapan.com/8723/
⇒ https://malware-log.hatenablog.com/entry/2019/04/22/000000_12

◆Dharma Ransomware Uses AV Tool to Distract from Malicious Activities (Trendmicro, 2019/05/08 04:50)
https://blog.trendmicro.com/trendlabs-security-intelligence/dharma-ransomware-uses-av-tool-to-distract-from-malicious-activities/
⇒ https://malware-log.hatenablog.com/entry/2019/05/08/000000_6

◆Ransomware: These are the most common attacks targeting you right now (ZDNet, 2019/10/16 13:24)

An analysis of ransomware reporting over the past six months shows that while there's a big focus on big targets, going after individual users is still very popular

https://www.zdnet.com/article/ransomware-these-are-the-most-common-attacks-targeting-you-right-now/
⇒ https://malware-log.hatenablog.com/entry/2019/10/16/000000_13

◆Ransomware Costs Double in Q4 as Ryuk, Sodinokibi Proliferate (Security Boulevard, 2020/01/23)
https://securityboulevard.com/2020/01/ransomware-costs-double-in-q4-as-ryuk-sodinokibi-proliferate/
⇒ https://malware-log.hatenablog.com/entry/2020/01/23/000000_11

◆Ransomware: These are the most common attacks targeting you right now (ZDNet, 2019/10/16 13:24)

An analysis of ransomware reporting over the past six months shows that while there's a big focus on big targets, going after individual users is still very popular

https://www.zdnet.com/article/ransomware-these-are-the-most-common-attacks-targeting-you-right-now/
⇒ https://malware-log.hatenablog.com/entry/2019/10/16/000000_13

■2020年

◆Ransomware Costs Double in Q4 as Ryuk, Sodinokibi Proliferate (Security Boulevard, 2020/01/23)
https://securityboulevard.com/2020/01/ransomware-costs-double-in-q4-as-ryuk-sodinokibi-proliferate/
⇒ https://malware-log.hatenablog.com/entry/2020/01/23/000000_11

◆Ransomware victims are paying out millions a month. One particular version has cost them the most (ZDNet, 2020/03/02 17:02)

Over six-and-a-half years, ransomware victims have handed over vast amounts of bitcoin to crooks. Some variants of the malware have generated more ransom than others
ランサムウェアの被害者は毎月数百万ドルを支払っています。1つの特定のバージョンはそれらに最もコストがかかります
ランサムウェアの被害者は6年半にわたって、膨大な量のビットコインを詐欺師に手渡しています。マルウェアの一部の亜種は、他の亜種よりも身代金を生成しています

https://www.zdnet.com/article/fbi-ransomware-victims-have-paid-out-140-million-one-version-has-cost-them-the-most/

◆Next-Gen Ransomware Packs a ‘Human’ Punch, Microsoft Warns (Threat Post, 2020/03/06 16:50)
https://threatpost.com/next-gen-ransomware-packs-a-human-punch-microsoft-warns/153501/
⇒ https://malware-log.hatenablog.com/entry/2020/03/06/000000_6

◆人間が操作する巧妙なランサムウェアで被害が拡大--マイクロソフトの調査 (ZDNet, 2020/03/10 14:22)
https://japan.zdnet.com/article/35150560/
⇒ https://malware-log.hatenablog.com/entry/2020/03/10/000000

◆Source code of Dharma ransomware pops up for sale on hacking forums (ZDNet, 2020/03/29 05:16)
https://www.zdnet.com/article/source-code-of-dharma-ransomware-pops-up-for-sale-on-hacking-forums/
⇒ https://malware-log.hatenablog.com/entry/2020/03/29/000000_3

◆Iran-Linked ‘Newbie’ Hackers Spread Dharma Ransomware Via RDP Ports (Threatpost, 2020/08/24 11:23)
[イランに関係した「初心者」ハッカーがRDPポートを介してダルマ・ランサムウェアを拡散]
https://threatpost.com/iran-linked-newbie-hackers-spread-dharma-ransomware-via-rdp-ports/158580/
⇒ https://malware-log.hatenablog.com/entry/2020/08/24/000000_1

■2021年

◆Police arrest hackers behind over 1,800 ransomware attacks (BleepingComputer, 2021/10/29 05:07)
[1,800件以上のランサムウェア攻撃を行ったハッカーを警察が逮捕]
https://www.bleepingcomputer.com/news/security/police-arrest-hackers-behind-over-1-800-ransomware-attacks/
⇒ https://malware-log.hatenablog.com/entry/2021/10/29/000000_6

【ブログ】

■2018年

◆New Variant of Dharma Ransomware Discovered (Latest Hacknig News, 2018/08/13)
[ダーマ・ランサムウェアの新種が発見される]
https://latesthackingnews.com/2018/08/13/new-variant-of-dharma-ransomware-discovered/
⇒ https://malware-log.hatenablog.com/entry/2018/08/13/000000_7

◆Dharma Ransomware: What It’s Teaching Us (Fortinet, 2018/11/12)
[ダーマ・ランサムウェアそれが教えてくれること]
https://www.fortinet.com/blog/threat-research/dharma-ransomware--what-it-s-teaching-us.html
⇒ http://malware-log.hatenablog.com/entry/2018/11/12/000000_8

◆New Dharma Ransomware Variant Detected (SpamTitan, 2018/11/13)
[ダーマ・ランサムウェアの新種が検出されました。]
https://www.spamtitan.com/blog/new-dharma-ransomware-variant-detected/
⇒ http://malware-log.hatenablog.com/entry/2018/11/13/000000_10

◆Carbon Black TAU Threat Analysis: Recent Dharma Ransomware Highlights Attackers’ Continued Use of Open-Source Tools (Carbon Black, 2018/07/10)
[カーボンブラックTAU脅威分析。最近の Dharma ランサムウェアは、攻撃者がオープンソースツールを継続的に使用していることを浮き彫りにしています]
https://www.carbonblack.com/2018/07/10/carbon-black-tau-threat-analysis-recent-dharma-ransomware-highlights-attackers-continued-use-open-source-tools/
⇒ http://malware-log.hatenablog.com/entry/2018/07/10/000000_7

■2019年

◆ランサムウェア「Dharma」、不正活動を隠ぺいするために正規ソフトウェアを利用 (Trendmicro, 2019/05/20)
https://blog.trendmicro.co.jp/archives/21215
⇒ https://malware-log.hatenablog.com/archive/2019/05/20

■2020年

◆Human-operated ransomware attacks: A preventable disaster (Microsoft, 2020/03/05)
[人間が操作するランサムウェア攻撃。予防可能な災害]
https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/
⇒ https://malware-log.hatenablog.com/entry/2020/03/05/000000_5

◆Targeted Dharma Ransomware Intrusions Exhibit Consistent Techniques (CrowsStrike, 2020/04/16)
[標的型ダルマ・ランサムウェアの侵入は一貫した手法を示す]
https://www.crowdstrike.com/blog/targeted-dharma-ransomware-intrusions-exhibit-consistent-techniques/
⇒ https://malware-log.hatenablog.com/entry/2020/04/16/000000_4

◆New Hacker Group Spread ‘Dharma’ Ransomware Via RDP Ports – Iran Link! (PSBE Cyber News Group, 2020/08/25)
[新たなハッカーグループがRDPポート経由で「Dharma」ランサムウェアを拡散-イランリンク]
https://www.cybernewsgroup.co.uk/new-hacker-group-spread-dharma-ransomware-via-rdp-ports-iran-link/

【公開情報】

■2016年

◆Dharma Ransomware を削除する方法 (Cyber Security Experts, 2016/11/18)
http://www.4-cybersecurity.com/jp/delete-dharma-ransomware/
⇒ http://malware-log.hatenablog.com/entry/2016/11/18/000000

■2017年

◆Dharma ランサムウェア・ウィルス. 除去するには？ (アンインストール・ガイド) (uirusu.jp, 2017/01/26)
http://uirusu.jp/dharma-%E3%83%A9%E3%83%B3%E3%82%B5%E3%83%A0%E3%82%A6%E3%82%A7%E3%82%A2%E3%83%BB%E3%82%A6%E3%82%A3%E3%83%AB%E3%82%B9/
⇒ http://malware-log.hatenablog.com/entry/2017/01/26/000000_4

■2018年

◆Threat Landscape Dashboard Dharma - Ransomware (McAfee, 2018/07/25)
https://www.mcafee.com/enterprise/en-us/threat-center/threat-landscape-dashboard/ransomware-details.dharma-ransomware.html
⇒ http://malware-log.hatenablog.com/entry/2018/07/25/000000_14

■2020年

◆ROGER Ransomware (Anti-spyware 101, 2020/01/28)
https://anti-spyware-101.com/remove-roger-ransomware
⇒ https://malware-log.hatenablog.com/entry/2020/01/28/000000_10

◆「.ROGER」「.ncov」「.self」拡張子に暗号化するDharmaランサムウェア (MDBA, 2020/03/02)
http://mdba.info/ransomware/2020/03/02/%E3%80%8C-roger%E3%80%8D%E3%80%8C-ncov%E3%80%8D%E3%80%8C-self%E3%80%8D%E6%8B%A1%E5%BC%B5%E5%AD%90%E3%81%AB%E6%9A%97%E5%8F%B7%E5%8C%96%E3%81%99%E3%82%8Bdharma%E3%83%A9%E3%83%B3%E3%82%B5%E3%83%A0/
⇒ https://malware-log.hatenablog.com/entry/2020/03/02/000000_2

【資料】

■2018年

◆Ransomware from the Crysis/Dharma family Report (Panda, 2017/11)
https://www.pandasecurity.com/mediacenter/src/uploads/2017/11/Ransomware_Crysis-Dharma-en.pdf
⇒ http://malware-log.hatenablog.com/entry/2017/11/30/000000_6

◆SophosLabs 2019 Threat Report　(sophos, 2018/11/25)
https://www.sophos.com/en-us/medialibrary/pdfs/technical-papers/sophoslabs-2019-threat-report.pdf
⇒ http://malware-log.hatenablog.com/entry/2018/11/25/000000_2

■2020年