Dharma Ransomware Description
The Dharma Ransomware is an encryption ransomware Trojan that is being used to extort computer users. There have been numerous computers around the world that have been infected by the Dharma Ransomware. The Dharma Ransomware seems to target only the directories inside the Users directory on Windows, with encrypted files receiving the suffix [bitcoin143@india.com].dharma added to the end of each file name. Variants of the Dharma Ransomware will sometimes not have a ransom note. The Dharma Ransomware does not stop the affected computer from working properly, but every time a file is added to the targeted directories, it will be encrypted unless the Dharma Ransomware infection is removed.
The Dharma Ransomware may Change It's Name
Some computer users have reported that the file being used to deliver the Dharma Ransomware also may be named 'skanda.exe,' although this depends on the variant being used in the attack. Once the Dharma Ransomware has encrypted a file, it will no longer be readable by the victim's applications until it is decrypted. Unfortunately, to decrypt the files that have been affected by the Dharma Ransomware, it is necessary to have the decryption key, which the people responsible for the Dharma Ransomware will hold until the victim pays a ransom. A different variant of the Dharma Ransomware is contained in a folder named 'opFirlma,' which contained the application 'plinck.exe.' It is highly likely that these are randomly generated. Some variants of the Dharma Ransomware will include a ransom note contained in a text file named 'README.txt,' which will deliver the following message:
'ATTENTION!
At the moment, your system is not protected.
We can fix it and restore files.
To restore the system write to this address:
bitcoin143@india.com'
How the Dharma Ransomware Infection Works
PC security analysts suspect that the Dharma Ransomware is one of the many variants of the infamous Crysis Ransomware family, which was responsible for numerous attacks since Summer of 2016. The Dharma Ransomware and its variants seem to be distributed using corrupted email attachments that will often exploit vulnerabilities in macros on the victim's computer. It is possible that the Dharma Ransomware is still under development since some samples of the Dharma Ransomware appear to be incomplete, often not containing ransom notes or other basic functions of these attacks. The Dharma Ransomware infection is fairly typical of these encryption ransomware attacks. The Dharma Ransomware uses the AES-256 encryption to take over the victim's data, preventing computer users from accessing their files. The Dharma Ransomware attacks will target the following directories:
- %UserProfile%\Desktop
- %UserProfile%\Downloads
- %UserProfile%\Documents
- %UserProfile%\Pictures
- %UserProfile%\Music
- %UserProfile%\Videos
Dealing with the Dharma Ransomware
PC security analysts strongly advise computer users against paying the Dharma Ransomware ransom. It is very unlikely that the people responsible for the Dharma Ransomware will provide the means to decrypt the infected files, especially in the case of the Dharma Ransomware, where it is clearly still under development. In fact, it is equally likely that the people responsible for the Dharma Ransomware attack will simply ask the victim to pay more money or simply ignore the victim's requests.
As with most encryption ransomware Trojans, the best solution to the attack is to take steps to establish a good backup system. This way, computer users can recover from a Dharma Ransomware attack by restoring their files from the backup copy, with no need to pay the ransom. In fact, if having file backups becomes a regular, widespread practice, attacks like the Dharma Ransomware will likely cease to exist, since the people responsible for these threats will no longer have any way to force computer users into paying the ransom to regain access to their own files. Malware analysts also advise computer users to take care when handling emails, since the Dharma Ransomware may spread through corrupted email attachments.
Technical Information
File System Details
# | File Name | Size | MD5 | Detection Count |
---|---|---|---|---|
1 | %APPDATA%Info.hta | 13,635 | 44d93d15807455a527283c6fedf65762 | 556 |
2 | %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Information.hta | 13,637 | d0f94ea59e72e62ea6e6f058a5bba1a7 | 301 |
3 | %SystemDrive%\Users\marcos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload00.exe | 335,665 | faccdfb32516a9c2dbe714a73712b764 | 104 |
4 | %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\Inf.hta | 13,641 | 1bf867566ccfc201dcf9688a9a21d80b | 46 |
5 | %WINDIR%\System32\Payload_c.exe | 399,666 | c001d4d8732a4613fec008770b0fa9bc | 31 |
6 | %SystemDrive%\Users\db2admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload5.exe | 278,318 | b097e84cd3abd15f564f1e0b77cb2d50 | 26 |
7 | %SystemDrive%\Users\Oficina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload.exe | 357,887 | 03ab0fb5eeeb8424cd921127f13ad52c | 25 |
8 | %WINDIR%\System32\inter2811_bandugan_1.exe | 332,800 | 703c42e5456731444cf68cc27fdfbe96 | 24 |
9 | %SystemDrive%\Users\postgres\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\setap_c.exe | 296,241 | e1f72b51728198f2320b8fa7e95244e9 | 21 |
10 | %SystemDrive%\Users\amit\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe | 224,308 | 674bfb3719ce1b9d30dd906c20251090 | 20 |
11 | %APPDATA%setap28.exe | 310,581 | 1e1bf7697917466739cb5d8c9b31f7d3 | 19 |
12 | %SystemDrive%\Users\contabilidad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload(1)_c.exe | 214,322 | 7fb036338464c8dcf226c8b269227b65 | 17 |
13 | %SystemDrive%\Users\Sergio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload2.exe | 338,197 | a9f94a2a8501bf15d8ac1eef95cce3e4 | 16 |
14 | %SystemDrive%\Users\CANTERA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload0.exe | 324,400 | 17bf92deca1953c6ebf2aafb5bf8ebf1 | 15 |
15 | %SystemDrive%\Users\lachlan\AppData\Roaming\setap30.exe | 303,413 | eb39803ca6b4540d3001562e07e30ed7 | 10 |
16 | %SystemDrive%\Users\johann\AppData\Roaming\Payload31.exe | 326,513 | db2a372dfcaa0dbba4aaff2eaeb5e516 | 9 |
17 | %SystemDrive%\Users\server\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload30.exe | 343,308 | f6fafa7b9508f9f03ed6c8e4f43f3bb4 | 8 |
18 | %SystemDrive%\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload12.exe | 343,856 | d8f6ff36e853b4ea86b7d8b771ea2a89 | 8 |
19 | %SystemDrive%\Users\Bureau\AppData\Roaming\payload_CHKS26_c.exe | 378,193 | 52d740c82f8d0437cf877d688c7a91a7 | 8 |
20 | %SystemDrive%\Users\alough\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payloadn_c.exe | 344,064 | 8d88bb7595cc40e311740c9487684020 | 7 |
21 | %SystemDrive%\Users\KRISHNA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Payload03.exe | 337,711 | cdc19024a2e99c62987dc2c29b7c4322 | 7 |
22 | %SystemDrive%\Users\Matthew\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\setap00.exe | 235,860 | 5c2fda3a416193055cc02a6cc6876ca7 | 3 |
23 | %SYSTEMDRIVE%\users\mary\desktop\1801.exe | 399,872 | 44d550f8ac8711121fe76400727176df | 3 |
24 | setap2.exe | 238,080 | 0c4a4b52238ea12c27a9ec657cace53f | 2 |
25 | file.exe | 375,296 | 56823c9b1a3f5eb2dd1d41d34d9894b4 | 0 |
Related Posts
- Dharma-Ninja Ransomware
- Dharma-Gate Ransomware
- Dharma-Boost Ransomware
- Cmb Dharma Ransomware
- Java NotDharma Ransomware
Site Disclaimer
This article is provided "as is" and to be used for educational information purposes only. By following any instructions on this article, you agree to be bound by the disclaimer. We make no guarantees that this article will help you completely remove the malware threats on your computer. Spyware changes regularly; therefore, it is difficult to fully clean an infected machine through manual means.
all my files ar crypted see "2019.xlsx.id-4E0C2331.[admin@sectex.net].bot" and when I attach an USB Stick this is also crypt. SpyHunter was running before attach