Dharma Ransomware

Dharma Ransomware Description

The Dharma Ransomware is an encryption ransomware Trojan that is being used to extort computer users. There have been numerous computers around the world that have been infected by the Dharma Ransomware. The Dharma Ransomware seems to target only the directories inside the Users directory on Windows, with encrypted files receiving the suffix [bitcoin143@india.com].dharma added to the end of each file name. Variants of the Dharma Ransomware will sometimes not have a ransom note. The Dharma Ransomware does not stop the affected computer from working properly, but every time a file is added to the targeted directories, it will be encrypted unless the Dharma Ransomware infection is removed.

The Dharma Ransomware may Change It's Name

Some computer users have reported that the file being used to deliver the Dharma Ransomware also may be named 'skanda.exe,' although this depends on the variant being used in the attack. Once the Dharma Ransomware has encrypted a file, it will no longer be readable by the victim's applications until it is decrypted. Unfortunately, to decrypt the files that have been affected by the Dharma Ransomware, it is necessary to have the decryption key, which the people responsible for the Dharma Ransomware will hold until the victim pays a ransom. A different variant of the Dharma Ransomware is contained in a folder named 'opFirlma,' which contained the application 'plinck.exe.' It is highly likely that these are randomly generated. Some variants of the Dharma Ransomware will include a ransom note contained in a text file named 'README.txt,' which will deliver the following message:

'ATTENTION!
At the moment, your system is not protected.
We can fix it and restore files.
To restore the system write to this address:
bitcoin143@india.com'

How the Dharma Ransomware Infection Works

PC security analysts suspect that the Dharma Ransomware is one of the many variants of the infamous Crysis Ransomware family, which was responsible for numerous attacks since Summer of 2016. The Dharma Ransomware and its variants seem to be distributed using corrupted email attachments that will often exploit vulnerabilities in macros on the victim's computer. It is possible that the Dharma Ransomware is still under development since some samples of the Dharma Ransomware appear to be incomplete, often not containing ransom notes or other basic functions of these attacks. The Dharma Ransomware infection is fairly typical of these encryption ransomware attacks. The Dharma Ransomware uses the AES-256 encryption to take over the victim's data, preventing computer users from accessing their files. The Dharma Ransomware attacks will target the following directories:

  • %UserProfile%\Desktop
  • %UserProfile%\Downloads
  • %UserProfile%\Documents
  • %UserProfile%\Pictures
  • %UserProfile%\Music
  • %UserProfile%\Videos

Dealing with the Dharma Ransomware

PC security analysts strongly advise computer users against paying the Dharma Ransomware ransom. It is very unlikely that the people responsible for the Dharma Ransomware will provide the means to decrypt the infected files, especially in the case of the Dharma Ransomware, where it is clearly still under development. In fact, it is equally likely that the people responsible for the Dharma Ransomware attack will simply ask the victim to pay more money or simply ignore the victim's requests.

As with most encryption ransomware Trojans, the best solution to the attack is to take steps to establish a good backup system. This way, computer users can recover from a Dharma Ransomware attack by restoring their files from the backup copy, with no need to pay the ransom. In fact, if having file backups becomes a regular, widespread practice, attacks like the Dharma Ransomware will likely cease to exist, since the people responsible for these threats will no longer have any way to force computer users into paying the ransom to regain access to their own files. Malware analysts also advise computer users to take care when handling emails, since the Dharma Ransomware may spread through corrupted email attachments.

Technical Information

File System Details

Dharma Ransomware creates the following file(s):
# File Name Size MD5 Detection Count
1 %APPDATA%Info.hta 13,635 44d93d15807455a527283c6fedf65762 556
2 %SystemDrive%\Users\balcao7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\setup.exe 140,288 2d138fc8252563e50b8d6c6cfb7d6989 392
3 %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Information.hta 13,637 d0f94ea59e72e62ea6e6f058a5bba1a7 301
4 %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\MRLK.exe 90,112 20a218209aeeb09a1c26a68794685a71 88
5 C:\Users\Administrator\AppData\Roaming\Host Process for Windows Services\svchost.exe 6,584,832 d077c92a3e3e7593c0f990e7130d46aa 87
6 %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Inf.hta 13,641 1bf867566ccfc201dcf9688a9a21d80b 46
7 %WINDIR%\System32\pld.exe 90,112 f583191dd74da9fde815e79f7a1c1fed 40
8 %WINDIR%\System32\setup1.exe 214,045 c4c74767ddd35728f381b6ae64de107b 34
9 %WINDIR%\System32\inter2811_bandugan_1.exe 332,800 703c42e5456731444cf68cc27fdfbe96 24
10 %SystemDrive%\Users\state\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1stk.exe 339,381 c376698b83bd3f54b43e4caeb316ae38 24
11 %SystemDrive%\Users\george\AppData\Roaming\setap1.exe 311,808 f6069500044e436e6c641d4c99e916dd 24
12 %WINDIR%\System32\payload_CHKS262.exe 254,464 b7805d8b96ebcf0b2e3b1b55b3605708 23
13 %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\payload_175ZZZ (1).exe 140,288 9982f1221273a0cafb421ebc200ebd43 23
14 %SystemDrive%\Users\amit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe 224,308 674bfb3719ce1b9d30dd906c20251090 20
15 %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\addon.exe 95,232 63f8f015faa71f2eb8f4627a77a1e348 19
16 %SYSTEMDRIVE%\users\administrator.dpworld\appdata\roaming\microsoft\windows\start menu\programs\startup\avflantuheems1984.exe 94,720 a752dfd15edc5b7b2b10c80233c1809b 15
17 %SystemDrive%\Users\Ahtam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\payload_172ZZZ.exe 140,288 a07bf0b049ff09c6a3c1971b7f84a971 9
18 %SystemDrive%\Users\Bureau\AppData\Roaming\payload_CHKS26_c.exe 378,193 52d740c82f8d0437cf877d688c7a91a7 8
19 %WINDIR%\System32\payload_127AMA1.exe 256,000 8ba337ad786a59d8a961a712ca7474ee 8
20 %SystemDrive%\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\payload_132MMK.exe 140,288 2ecfa708df7b1fd2bd131bba218011b9 6
21 %SYSTEMDRIVE%\users\rafaela.silva.christus.000\desktop\1iiri92_payload.exe 94,720 29320eedebbf9198c3dad888578d0707 6
22 %SystemDrive%\Users\director\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\payload_127AMA.exe 140,288 4b96b5eb51e95e55d6bb2a45503c1272 5
23 %SystemDrive%\Users\Matthew\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\setap00.exe 235,860 5c2fda3a416193055cc02a6cc6876ca7 3
24 %SYSTEMDRIVE%\users\mary\desktop\1801.exe 399,872 44d550f8ac8711121fe76400727176df 3
25 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\4d11ba0ab98bf4e61aba4524fa8afec3e87739d954b8a9b351998282706bbc3b.exe 349,112 96b01bbab000c95f7833fb7696834d9b 2
26 %WINDIR%\system32\expiorer.exe 94,720 babe40e55567b6a9f76864073c1821e6 2
27 C:\Users\user\AppData\Roaming\11.exe 226,304 ec443b1bc3affdf0565719a7385ac6d7 1
28 file.exe 375,296 56823c9b1a3f5eb2dd1d41d34d9894b4 0
More files

Related Posts

Site Disclaimer

Enigmasoftware.com is not associated, affiliated, sponsored or owned by the malware creators or distributors mentioned on this article. This article should NOT be mistaken or confused in being associated in any way with the promotion or endorsement of malware. Our intent is to provide information that will educate computer users on how to detect, and ultimately remove, malware from their computer with the help of SpyHunter and/or manual removal instructions provided on this article.

This article is provided "as is" and to be used for educational information purposes only. By following any instructions on this article, you agree to be bound by the disclaimer. We make no guarantees that this article will help you completely remove the malware threats on your computer. Spyware changes regularly; therefore, it is difficult to fully clean an infected machine through manual means.

One Comment

  • rowdy:
    6 months ago Reply

    all my files ar crypted see "2019.xlsx.id-4E0C2331.[admin@sectex.net].bot" and when I attach an USB Stick this is also crypt. SpyHunter was running before attach

Leave a Reply

Please DO NOT use this comment system for support or billing questions. For SpyHunter technical support requests, please contact our technical support team directly by opening a customer support ticket via your SpyHunter. For billing issues, please refer to our "Billing Questions or Problems?" page. For general inquiries (complaints, legal, press, marketing, copyright), visit our "Inquiries and Feedback" page.

Comment (1)
By GoldSparrow in Ransomware
Translate To: Chinese (Simplified) Chinese (Traditional) Português
Threat Scorecard
?
The ESL Threat Scorecard is an assessment report that is given to every malware threat that has been collected and analyzed through our Malware Research Center. The ESL Threat Scorecard evaluates and ranks each threat by using several metrics such as trends, incidents and severity over time.

In addition to the effective scoring for each threat, we are able to interpret anonymous geographic data to list the top three countries infected with a particular threat. The data used for the ESL Threat Scorecard is updated daily and displayed based on trends for a 30-day period. The ESL Threat Scorecard is a useful tool for a wide array of computer users from end users seeking a solution to remove a particular threat or security experts pursuing analysis and research data on emerging threats.

Each of the fields listed on the ESL Threat Scorecard, containing a specific value, are as follows:

Ranking: The current ranking of a particular threat among all the other threats found on our malware research database.

Threat Level: The level of threat a particular computer threat could have on an infected computer. The threat level is based on a particular threat's behavior and other risk factors. We rate the threat level as low, medium or high. The different threat levels are discussed in the SpyHunter Risk Assessment Model.

Infected Computer: The number of confirmed and suspected cases of a particular threat detected on infected computers retrieved from diagnostic and scan log reports generated by SpyHunter's Spyware Scanner.

% Change: The daily percent change in the frequency of infected computers of a specific threat. The formula for percent changes results from current trends of a specific threat. An increase in the rankings of a specific threat yields a recalculation of the percentage of its recent gain. When a specific threat's ranking decreases, the percentage rate reflects its recent decline. For a specific threat remaining unchanged, the percent change remains in its current state. The % Change data is calculated and displayed in three different date ranges, in the last 24 hours, 7 days and 30 days. Next to the percentage change is the trend movement a specific malware threat does, either upward or downward, in the rankings. Each level of movement is color coded: a green up-arrow (∧) indicates a rise, a red down-arrow (∨) indicates a decline, and a brown equal symbol (=) indicates no change or plateaued.

Top 3 Countries Infected: Lists the top three countries a particular threat has targeted the most over the past month. This data allows computer users to track the geographic distribution of a particular threat throughout the world.
Ranking: N/A
Threat Level: 10
Infected Computers: 25,713