Dharma Ransomware

Dharma Ransomware Description

The Dharma Ransomware is an encryption ransomware Trojan that is being used to extort computer users. There have been numerous computers around the world that have been infected by the Dharma Ransomware. The Dharma Ransomware seems to target only the directories inside the Users directory on Windows, with encrypted files receiving the suffix [bitcoin143@india.com].dharma added to the end of each file name. Variants of the Dharma Ransomware will sometimes not have a ransom note. The Dharma Ransomware does not stop the affected computer from working properly, but every time a file is added to the targeted directories, it will be encrypted unless the Dharma Ransomware infection is removed.

The Dharma Ransomware may Change It's Name

Some computer users have reported that the file being used to deliver the Dharma Ransomware also may be named 'skanda.exe,' although this depends on the variant being used in the attack. Once the Dharma Ransomware has encrypted a file, it will no longer be readable by the victim's applications until it is decrypted. Unfortunately, to decrypt the files that have been affected by the Dharma Ransomware, it is necessary to have the decryption key, which the people responsible for the Dharma Ransomware will hold until the victim pays a ransom. A different variant of the Dharma Ransomware is contained in a folder named 'opFirlma,' which contained the application 'plinck.exe.' It is highly likely that these are randomly generated. Some variants of the Dharma Ransomware will include a ransom note contained in a text file named 'README.txt,' which will deliver the following message:

'ATTENTION!
At the moment, your system is not protected.
We can fix it and restore files.
To restore the system write to this address:
bitcoin143@india.com'

How the Dharma Ransomware Infection Works

PC security analysts suspect that the Dharma Ransomware is one of the many variants of the infamous Crysis Ransomware family, which was responsible for numerous attacks since Summer of 2016. The Dharma Ransomware and its variants seem to be distributed using corrupted email attachments that will often exploit vulnerabilities in macros on the victim's computer. It is possible that the Dharma Ransomware is still under development since some samples of the Dharma Ransomware appear to be incomplete, often not containing ransom notes or other basic functions of these attacks. The Dharma Ransomware infection is fairly typical of these encryption ransomware attacks. The Dharma Ransomware uses the AES-256 encryption to take over the victim's data, preventing computer users from accessing their files. The Dharma Ransomware attacks will target the following directories:

  • %UserProfile%\Desktop
  • %UserProfile%\Downloads
  • %UserProfile%\Documents
  • %UserProfile%\Pictures
  • %UserProfile%\Music
  • %UserProfile%\Videos

Dealing with the Dharma Ransomware

PC security analysts strongly advise computer users against paying the Dharma Ransomware ransom. It is very unlikely that the people responsible for the Dharma Ransomware will provide the means to decrypt the infected files, especially in the case of the Dharma Ransomware, where it is clearly still under development. In fact, it is equally likely that the people responsible for the Dharma Ransomware attack will simply ask the victim to pay more money or simply ignore the victim's requests.

As with most encryption ransomware Trojans, the best solution to the attack is to take steps to establish a good backup system. This way, computer users can recover from a Dharma Ransomware attack by restoring their files from the backup copy, with no need to pay the ransom. In fact, if having file backups becomes a regular, widespread practice, attacks like the Dharma Ransomware will likely cease to exist, since the people responsible for these threats will no longer have any way to force computer users into paying the ransom to regain access to their own files. Malware analysts also advise computer users to take care when handling emails, since the Dharma Ransomware may spread through corrupted email attachments.

Technical Information

File System Details

Dharma Ransomware creates the following file(s):
# File Name Size MD5 Detection Count
1 %APPDATA%Info.hta 13,635 44d93d15807455a527283c6fedf65762 556
2 %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Information.hta 13,637 d0f94ea59e72e62ea6e6f058a5bba1a7 301
3 %SystemDrive%\Users\marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload00.exe 335,665 faccdfb32516a9c2dbe714a73712b764 104
4 %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Inf.hta 13,641 1bf867566ccfc201dcf9688a9a21d80b 46
5 %WINDIR%\System32\Payload_c.exe 399,666 c001d4d8732a4613fec008770b0fa9bc 31
6 %SystemDrive%\Users\db2admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload5.exe 278,318 b097e84cd3abd15f564f1e0b77cb2d50 26
7 %SystemDrive%\Users\Oficina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe 357,887 03ab0fb5eeeb8424cd921127f13ad52c 25
8 %WINDIR%\System32\inter2811_bandugan_1.exe 332,800 703c42e5456731444cf68cc27fdfbe96 24
9 %SystemDrive%\Users\postgres\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\setap_c.exe 296,241 e1f72b51728198f2320b8fa7e95244e9 21
10 %SystemDrive%\Users\amit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe 224,308 674bfb3719ce1b9d30dd906c20251090 20
11 %APPDATA%setap28.exe 310,581 1e1bf7697917466739cb5d8c9b31f7d3 19
12 %SystemDrive%\Users\contabilidad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload(1)_c.exe 214,322 7fb036338464c8dcf226c8b269227b65 17
13 %SystemDrive%\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload2.exe 338,197 a9f94a2a8501bf15d8ac1eef95cce3e4 16
14 %SystemDrive%\Users\CANTERA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload0.exe 324,400 17bf92deca1953c6ebf2aafb5bf8ebf1 15
15 %SystemDrive%\Users\lachlan\AppData\Roaming\setap30.exe 303,413 eb39803ca6b4540d3001562e07e30ed7 10
16 %SystemDrive%\Users\johann\AppData\Roaming\Payload31.exe 326,513 db2a372dfcaa0dbba4aaff2eaeb5e516 9
17 %SystemDrive%\Users\server\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload30.exe 343,308 f6fafa7b9508f9f03ed6c8e4f43f3bb4 8
18 %SystemDrive%\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload12.exe 343,856 d8f6ff36e853b4ea86b7d8b771ea2a89 8
19 %SystemDrive%\Users\Bureau\AppData\Roaming\payload_CHKS26_c.exe 378,193 52d740c82f8d0437cf877d688c7a91a7 8
20 %SystemDrive%\Users\alough\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payloadn_c.exe 344,064 8d88bb7595cc40e311740c9487684020 7
21 %SystemDrive%\Users\KRISHNA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload03.exe 337,711 cdc19024a2e99c62987dc2c29b7c4322 7
22 %SystemDrive%\Users\Matthew\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\setap00.exe 235,860 5c2fda3a416193055cc02a6cc6876ca7 3
23 %SYSTEMDRIVE%\users\mary\desktop\1801.exe 399,872 44d550f8ac8711121fe76400727176df 3
24 setap2.exe 238,080 0c4a4b52238ea12c27a9ec657cace53f 2
25 file.exe 375,296 56823c9b1a3f5eb2dd1d41d34d9894b4 0
More files

Related Posts

Site Disclaimer

Enigmasoftware.com is not associated, affiliated, sponsored or owned by the malware creators or distributors mentioned on this article. This article should NOT be mistaken or confused in being associated in any way with the promotion or endorsement of malware. Our intent is to provide information that will educate computer users on how to detect, and ultimately remove, malware from their computer with the help of SpyHunter and/or manual removal instructions provided on this article.

This article is provided "as is" and to be used for educational information purposes only. By following any instructions on this article, you agree to be bound by the disclaimer. We make no guarantees that this article will help you completely remove the malware threats on your computer. Spyware changes regularly; therefore, it is difficult to fully clean an infected machine through manual means.

One Comment

  • rowdy:
    9 months ago Reply

    all my files ar crypted see "2019.xlsx.id-4E0C2331.[admin@sectex.net].bot" and when I attach an USB Stick this is also crypt. SpyHunter was running before attach

Leave a Reply

Please DO NOT use this comment system for support or billing questions. For SpyHunter technical support requests, please contact our technical support team directly by opening a customer support ticket via your SpyHunter. For billing issues, please refer to our "Billing Questions or Problems?" page. For general inquiries (complaints, legal, press, marketing, copyright), visit our "Inquiries and Feedback" page.

Comment (1)
By GoldSparrow in Ransomware
Translate To: Chinese (Simplified) Chinese (Traditional) Português
Threat Scorecard
?
The ESL Threat Scorecard is an assessment report that is given to every malware threat that has been collected and analyzed through our Malware Research Center. The ESL Threat Scorecard evaluates and ranks each threat by using several metrics such as trends, incidents and severity over time.

In addition to the effective scoring for each threat, we are able to interpret anonymous geographic data to list the top three countries infected with a particular threat. The data used for the ESL Threat Scorecard is updated daily and displayed based on trends for a 30-day period. The ESL Threat Scorecard is a useful tool for a wide array of computer users from end users seeking a solution to remove a particular threat or security experts pursuing analysis and research data on emerging threats.

Each of the fields listed on the ESL Threat Scorecard, containing a specific value, are as follows:

Ranking: The current ranking of a particular threat among all the other threats found on our malware research database.

Threat Level: The level of threat a particular computer threat could have on an infected computer. The threat level is based on a particular threat's behavior and other risk factors. We rate the threat level as low, medium or high. The different threat levels are discussed in the SpyHunter Risk Assessment Model.

Infected Computer: The number of confirmed and suspected cases of a particular threat detected on infected computers retrieved from diagnostic and scan log reports generated by SpyHunter's Spyware Scanner.

% Change: The daily percent change in the frequency of infected computers of a specific threat. The formula for percent changes results from current trends of a specific threat. An increase in the rankings of a specific threat yields a recalculation of the percentage of its recent gain. When a specific threat's ranking decreases, the percentage rate reflects its recent decline. For a specific threat remaining unchanged, the percent change remains in its current state. The % Change data is calculated and displayed in three different date ranges, in the last 24 hours, 7 days and 30 days. Next to the percentage change is the trend movement a specific malware threat does, either upward or downward, in the rankings. Each level of movement is color coded: a green up-arrow (∧) indicates a rise, a red down-arrow (∨) indicates a decline, and a brown equal symbol (=) indicates no change or plateaued.

Top 3 Countries Infected: Lists the top three countries a particular threat has targeted the most over the past month. This data allows computer users to track the geographic distribution of a particular threat throughout the world.
Ranking: N/A
Threat Level: 10
Infected Computers: 24,873