Dharma Ransomware

Threat Scorecard

Ranking: 6,045
Threat Level: 100 % (High)
Infected Computers: 26,271
First Seen: November 17, 2016
Last Seen: September 11, 2023
OS(es) Affected: Windows

The Dharma Ransomware is an encryption ransomware Trojan that is being used to extort computer users. There have been numerous computers around the world that have been infected by the Dharma Ransomware. The Dharma Ransomware seems to target only the directories inside the Users directory on Windows, with encrypted files receiving the suffix [bitcoin143@india.com].dharma added to the end of each file name. Variants of the Dharma Ransomware will sometimes not have a ransom note. The Dharma Ransomware does not stop the affected computer from working properly, but every time a file is added to the targeted directories, it will be encrypted unless the Dharma Ransomware infection is removed.

The Dharma Ransomware may Change It’s Name

Some computer users have reported that the file being used to deliver the Dharma Ransomware also may be named 'skanda.exe,' although this depends on the variant being used in the attack. Once the Dharma Ransomware has encrypted a file, it will no longer be readable by the victim's applications until it is decrypted. Unfortunately, to decrypt the files that have been affected by the Dharma Ransomware, it is necessary to have the decryption key, which the people responsible for the Dharma Ransomware will hold until the victim pays a ransom. A different variant of the Dharma Ransomware is contained in a folder named 'opFirlma,' which contained the application 'plinck.exe.' It is highly likely that these are randomly generated. Some variants of the Dharma Ransomware will include a ransom note contained in a text file named 'README.txt,' which will deliver the following message:

At the moment, your system is not protected.
We can fix it and restore files.
To restore the system write to this address:

How the Dharma Ransomware Infection Works

PC security analysts suspect that the Dharma Ransomware is one of the many variants of the infamous Crysis Ransomware family, which was responsible for numerous attacks since Summer of 2016. The Dharma Ransomware and its variants seem to be distributed using corrupted email attachments that will often exploit vulnerabilities in macros on the victim's computer. It is possible that the Dharma Ransomware is still under development since some samples of the Dharma Ransomware appear to be incomplete, often not containing ransom notes or other basic functions of these attacks. The Dharma Ransomware infection is fairly typical of these encryption ransomware attacks. The Dharma Ransomware uses the AES-256 encryption to take over the victim's data, preventing computer users from accessing their files. The Dharma Ransomware attacks will target the following directories:

  • %UserProfile%\Desktop
  • %UserProfile%\Downloads
  • %UserProfile%\Documents
  • %UserProfile%\Pictures
  • %UserProfile%\Music
  • %UserProfile%\Videos

Dealing with the Dharma Ransomware

PC security analysts strongly advise computer users against paying the Dharma Ransomware ransom. It is very unlikely that the people responsible for the Dharma Ransomware will provide the means to decrypt the infected files, especially in the case of the Dharma Ransomware, where it is clearly still under development. In fact, it is equally likely that the people responsible for the Dharma Ransomware attack will simply ask the victim to pay more money or simply ignore the victim's requests.

As with most encryption ransomware Trojans, the best solution to the attack is to take steps to establish a good backup system. This way, computer users can recover from a Dharma Ransomware attack by restoring their files from the backup copy, with no need to pay the ransom. In fact, if having file backups becomes a regular, widespread practice, attacks like the Dharma Ransomware will likely cease to exist, since the people responsible for these threats will no longer have any way to force computer users into paying the ransom to regain access to their own files. Malware analysts also advise computer users to take care when handling emails, since the Dharma Ransomware may spread through corrupted email attachments.

SpyHunter Detects & Remove Dharma Ransomware

File System Details

Dharma Ransomware may create the following file(s):
# File Name MD5 Detections
1. Info.hta ce5451a17a72300ed0f75e3d8de29708 36
2. Info.hta 58a93aa9dcbd009d4069b65c54bcd80f 35
3. Info.hta bdc3fca6533c4b1bccc953e7b02137d4 33
4. Info.hta 53e186e8ec9c89845580515b57f42645 31
5. Info.hta 0d4f31aed025f9bb79b93cc87160438e 31
6. Info.hta 052913d7a6a09437d38d00d747887966 27
7. Info.hta 82677bdaa1ffd8b2711deaf20e901e12 19
8. Info.hta 8a220990e2b0777f21bd4f67e7579196 17
9. Info.hta bca4f4c05300a60d4f8ce9822ae252bb 17
10. Info.hta 940ce88a73a6a09056ef8485adf9a251 17
11. Info.hta 9b8ff0f3c4a29d9f7e469df6ed26e876 16
12. Info.hta afe42573db1509a8af29d322ac68a212 15
13. Info.hta 46c2099abfb5bf6232a4cebd4c6315aa 15
14. Info.hta c67cfb21a35d0f0d87695cec41091955 15
15. Info.hta 34cab96384ec9ced3bf3622ad28c3a64 15
16. Info.hta 92e58f01a7f258403672f6e9409bf9ba 15
17. Info.hta 1b8e9834e05471e504f75eae50ade90d 13
18. Info.hta 0c9c7d1ecf357c70af0836064885faea 12
19. Info.hta 20abbe33e018ca4cd97e41f8cb82bb2d 12
20. Info.hta 0b707f178039ee3e199c9b46c0f25467 12
21. Info.hta 65f5f994d7f36f7ed60eb4e812300f05 12
22. Info.hta 6dddb8c4f20b570a0200beca9bb1f7f2 12
23. Info.hta 7ee01de4ec71ba5f66d959faca1af8fa 11
24. payload.exe d1487253cee49b68aebae1481e34f8fd 11
25. 1801.exe 44d550f8ac8711121fe76400727176df 3
26. file.exe 0bac30f9c6da0ca96dc28d658ec2ecf4 2
27. file.exe b84e41893fa55503a84688b36556db05 1
More files

1 Comment

all my files ar crypted see "2019.xlsx.id-4E0C2331.[admin@sectex.net].bot" and when I attach an USB Stick this is also crypt. SpyHunter was running before attach

Related Posts


Most Viewed