Dharma Ransomware
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Ranking: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
Ranking: | 6,045 |
Threat Level: | 100 % (High) |
Infected Computers: | 26,271 |
First Seen: | November 17, 2016 |
Last Seen: | September 11, 2023 |
OS(es) Affected: | Windows |
The Dharma Ransomware is an encryption ransomware Trojan that is being used to extort computer users. There have been numerous computers around the world that have been infected by the Dharma Ransomware. The Dharma Ransomware seems to target only the directories inside the Users directory on Windows, with encrypted files receiving the suffix [bitcoin143@india.com].dharma added to the end of each file name. Variants of the Dharma Ransomware will sometimes not have a ransom note. The Dharma Ransomware does not stop the affected computer from working properly, but every time a file is added to the targeted directories, it will be encrypted unless the Dharma Ransomware infection is removed.
Table of Contents
The Dharma Ransomware may Change It’s Name
Some computer users have reported that the file being used to deliver the Dharma Ransomware also may be named 'skanda.exe,' although this depends on the variant being used in the attack. Once the Dharma Ransomware has encrypted a file, it will no longer be readable by the victim's applications until it is decrypted. Unfortunately, to decrypt the files that have been affected by the Dharma Ransomware, it is necessary to have the decryption key, which the people responsible for the Dharma Ransomware will hold until the victim pays a ransom. A different variant of the Dharma Ransomware is contained in a folder named 'opFirlma,' which contained the application 'plinck.exe.' It is highly likely that these are randomly generated. Some variants of the Dharma Ransomware will include a ransom note contained in a text file named 'README.txt,' which will deliver the following message:
'ATTENTION!
At the moment, your system is not protected.
We can fix it and restore files.
To restore the system write to this address:
bitcoin143@india.com'
How the Dharma Ransomware Infection Works
PC security analysts suspect that the Dharma Ransomware is one of the many variants of the infamous Crysis Ransomware family, which was responsible for numerous attacks since Summer of 2016. The Dharma Ransomware and its variants seem to be distributed using corrupted email attachments that will often exploit vulnerabilities in macros on the victim's computer. It is possible that the Dharma Ransomware is still under development since some samples of the Dharma Ransomware appear to be incomplete, often not containing ransom notes or other basic functions of these attacks. The Dharma Ransomware infection is fairly typical of these encryption ransomware attacks. The Dharma Ransomware uses the AES-256 encryption to take over the victim's data, preventing computer users from accessing their files. The Dharma Ransomware attacks will target the following directories:
- %UserProfile%\Desktop
- %UserProfile%\Downloads
- %UserProfile%\Documents
- %UserProfile%\Pictures
- %UserProfile%\Music
- %UserProfile%\Videos
Dealing with the Dharma Ransomware
PC security analysts strongly advise computer users against paying the Dharma Ransomware ransom. It is very unlikely that the people responsible for the Dharma Ransomware will provide the means to decrypt the infected files, especially in the case of the Dharma Ransomware, where it is clearly still under development. In fact, it is equally likely that the people responsible for the Dharma Ransomware attack will simply ask the victim to pay more money or simply ignore the victim's requests.
As with most encryption ransomware Trojans, the best solution to the attack is to take steps to establish a good backup system. This way, computer users can recover from a Dharma Ransomware attack by restoring their files from the backup copy, with no need to pay the ransom. In fact, if having file backups becomes a regular, widespread practice, attacks like the Dharma Ransomware will likely cease to exist, since the people responsible for these threats will no longer have any way to force computer users into paying the ransom to regain access to their own files. Malware analysts also advise computer users to take care when handling emails, since the Dharma Ransomware may spread through corrupted email attachments.
SpyHunter Detects & Remove Dharma Ransomware

File System Details
# | File Name | MD5 |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
---|---|---|---|
1. | Info.hta | ce5451a17a72300ed0f75e3d8de29708 | 36 |
2. | Info.hta | 58a93aa9dcbd009d4069b65c54bcd80f | 35 |
3. | Info.hta | bdc3fca6533c4b1bccc953e7b02137d4 | 33 |
4. | Info.hta | 53e186e8ec9c89845580515b57f42645 | 31 |
5. | Info.hta | 0d4f31aed025f9bb79b93cc87160438e | 31 |
6. | Info.hta | 052913d7a6a09437d38d00d747887966 | 27 |
7. | Info.hta | 82677bdaa1ffd8b2711deaf20e901e12 | 19 |
8. | Info.hta | 8a220990e2b0777f21bd4f67e7579196 | 17 |
9. | Info.hta | bca4f4c05300a60d4f8ce9822ae252bb | 17 |
10. | Info.hta | 940ce88a73a6a09056ef8485adf9a251 | 17 |
11. | Info.hta | 9b8ff0f3c4a29d9f7e469df6ed26e876 | 16 |
12. | Info.hta | afe42573db1509a8af29d322ac68a212 | 15 |
13. | Info.hta | 46c2099abfb5bf6232a4cebd4c6315aa | 15 |
14. | Info.hta | c67cfb21a35d0f0d87695cec41091955 | 15 |
15. | Info.hta | 34cab96384ec9ced3bf3622ad28c3a64 | 15 |
16. | Info.hta | 92e58f01a7f258403672f6e9409bf9ba | 15 |
17. | Info.hta | 1b8e9834e05471e504f75eae50ade90d | 13 |
18. | Info.hta | 0c9c7d1ecf357c70af0836064885faea | 12 |
19. | Info.hta | 20abbe33e018ca4cd97e41f8cb82bb2d | 12 |
20. | Info.hta | 0b707f178039ee3e199c9b46c0f25467 | 12 |
21. | Info.hta | 65f5f994d7f36f7ed60eb4e812300f05 | 12 |
22. | Info.hta | 6dddb8c4f20b570a0200beca9bb1f7f2 | 12 |
23. | Info.hta | 7ee01de4ec71ba5f66d959faca1af8fa | 11 |
24. | payload.exe | d1487253cee49b68aebae1481e34f8fd | 11 |
25. | 1801.exe | 44d550f8ac8711121fe76400727176df | 3 |
26. | file.exe | 0bac30f9c6da0ca96dc28d658ec2ecf4 | 2 |
27. | file.exe | b84e41893fa55503a84688b36556db05 | 1 |