Dharma Ransomware

The Dharma Ransomware is an encryption ransomware Trojan that is being used to extort computer users. There have been numerous computers around the world that have been infected by the Dharma Ransomware. The Dharma Ransomware seems to target only the directories inside the Users directory on Windows, with encrypted files receiving the suffix [bitcoin143@india.com].dharma added to the end of each file name. Variants of the Dharma Ransomware will sometimes not have a ransom note. The Dharma Ransomware does not stop the affected computer from working properly, but every time a file is added to the targeted directories, it will be encrypted unless the Dharma Ransomware infection is removed.

The Dharma Ransomware may Change It's Name

Some computer users have reported that the file being used to deliver the Dharma Ransomware also may be named 'skanda.exe,' although this depends on the variant being used in the attack. Once the Dharma Ransomware has encrypted a file, it will no longer be readable by the victim's applications until it is decrypted. Unfortunately, to decrypt the files that have been affected by the Dharma Ransomware, it is necessary to have the decryption key, which the people responsible for the Dharma Ransomware will hold until the victim pays a ransom. A different variant of the Dharma Ransomware is contained in a folder named 'opFirlma,' which contained the application 'plinck.exe.' It is highly likely that these are randomly generated. Some variants of the Dharma Ransomware will include a ransom note contained in a text file named 'README.txt,' which will deliver the following message:

'ATTENTION!
At the moment, your system is not protected.
We can fix it and restore files.
To restore the system write to this address:
bitcoin143@india.com'

How the Dharma Ransomware Infection Works

PC security analysts suspect that the Dharma Ransomware is one of the many variants of the infamous Crysis Ransomware family, which was responsible for numerous attacks since Summer of 2016. The Dharma Ransomware and its variants seem to be distributed using corrupted email attachments that will often exploit vulnerabilities in macros on the victim's computer. It is possible that the Dharma Ransomware is still under development since some samples of the Dharma Ransomware appear to be incomplete, often not containing ransom notes or other basic functions of these attacks. The Dharma Ransomware infection is fairly typical of these encryption ransomware attacks. The Dharma Ransomware uses the AES-256 encryption to take over the victim's data, preventing computer users from accessing their files. The Dharma Ransomware attacks will target the following directories:

• %UserProfile%\Desktop
• %UserProfile%\Downloads
• %UserProfile%\Documents
• %UserProfile%\Pictures
• %UserProfile%\Music
• %UserProfile%\Videos

Dealing with the Dharma Ransomware

PC security analysts strongly advise computer users against paying the Dharma Ransomware ransom. It is very unlikely that the people responsible for the Dharma Ransomware will provide the means to decrypt the infected files, especially in the case of the Dharma Ransomware, where it is clearly still under development. In fact, it is equally likely that the people responsible for the Dharma Ransomware attack will simply ask the victim to pay more money or simply ignore the victim's requests.

As with most encryption ransomware Trojans, the best solution to the attack is to take steps to establish a good backup system. This way, computer users can recover from a Dharma Ransomware attack by restoring their files from the backup copy, with no need to pay the ransom. In fact, if having file backups becomes a regular, widespread practice, attacks like the Dharma Ransomware will likely cease to exist, since the people responsible for these threats will no longer have any way to force computer users into paying the ransom to regain access to their own files. Malware analysts also advise computer users to take care when handling emails, since the Dharma Ransomware may spread through corrupted email attachments.

Technical Information

Related Posts

• Dharma-Ninja Ransomware
• Dharma-Gate Ransomware
• Dharma-Boost Ransomware
• Cmb Dharma Ransomware
• Java NotDharma Ransomware

Site Disclaimer