Categories: Ransom

About “Ransom.Dharma.50” infection

The Ransom.Dharma.50 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ransom.Dharma.50 virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
Reads data out of its own binary image
The binary likely contains encrypted or compressed data.
Executed a process and injected code into it, probably while unpacking
Queries information on disks, possibly for anti-virtualization
Attempts to restart the guest VM
Spoofs its process name and/or associated pathname to appear as a legitimate process
Anomalous binary characteristics

How to determine Ransom.Dharma.50?


File Info:
crc32: B816D866md5: a7e66deee373b2fd9cb1910f0b296080name: A7E66DEEE373B2FD9CB1910F0B296080.mlwsha1: a49f98802cc220600ae294ad6488401e35de044csha256: 8d081c88a4d12975aaf67abdacede7db5c4c7bc78c614abe4ecbec3aab7d0df7sha512: 726bcab9922eda506dea31626344e83dc60cbc6e952f12908325f2e5a6a5591571e4398e3b58e06d8ac4e942099d3cd09fc568f29d7c8ec46109e30e625aac90ssdeep: 12288:9e78DGTTgC0StlBN+DcdGe3fKTscN3dQCUoVPyJcvqWNpxAKpVW:s1XgJSXBNP3SfdxVPyJci8nAKptype: PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed
Version Info:
0: [No Data]

Ransom.Dharma.50 also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 005403ae1 )
Elastic	malicious (high confidence)
DrWeb	Trojan.Inject3.11639
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Ransom.Dharma.50
Malwarebytes	Malware.Heuristic.1001
Zillya	Backdoor.Backboot.Win32.104
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_70% (D)
Alibaba	Backdoor:Win32/Backboot.f8ae468d
K7GW	Trojan ( 005403ae1 )
Cybereason	malicious.ee373b
Cyren	W32/Risk.WBHO-7277
Symantec	Ransom.GandCrab
ESET-NOD32	a variant of Win32/Kryptik.GMHX
Zoner	Trojan.Win32.73365
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	Backdoor.Win32.Backboot.tm
BitDefender	Gen:Variant.Ransom.Dharma.50
NANO-Antivirus	Trojan.Win32.Backboot.fkerrb
MicroWorld-eScan	Gen:Variant.Ransom.Dharma.50
Tencent	Malware.Win32.Gencirc.116db0cb
Ad-Aware	Gen:Variant.Ransom.Dharma.50
Sophos	Mal/Generic-S
Comodo	Malware@#26uan85pgrgyx
BitDefenderTheta	AI:Packer.ACA576041F
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Corrupt.jc
FireEye	Generic.mg.a7e66deee373b2fd
Emsisoft	Gen:Variant.Ransom.Dharma.50 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	TrojanSpy.Stealer.ox
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1120731
eGambit	Unsafe.AI_Score_99%
Microsoft	Trojan:Win32/Occamy.C
AegisLab	Trojan.Win32.Backboot.4!c
GData	Gen:Variant.Ransom.Dharma.50
AhnLab-V3	Malware/Win32.Generic.C2808030
McAfee	Artemis!A7E66DEEE373
MAX	malware (ai score=100)
VBA32	BScope.TrojanRansom.Crusis
Panda	Trj/CI.A
Rising	Backdoor.Backboot!8.DE4B (CLOUD)
Yandex	Backdoor.Backboot!doAzFi3zeB8
Ikarus	Trojan.Win32.Pitou
Fortinet	W32/Generic.AP.157148E!tr
AVG	Win32:Trojan-gen
Paloalto	generic.ml
Qihoo-360	Win32/Backdoor.Backboot.HxEAEpsA