.DHARMA File Extension
File TypeDharma Ransomware Encrypted File
What is a DHARMA file?
A file with a .dharma extension is a file that has been encrypted by the Dharma virus, which is a variant of Crysis ransomware. It is encrypted so it is not possible to open the file by simply changing the .dharma file extension.
Dharma ransomware is a type of malware utilized by cybercriminals that encrypts a user's files. After the ransomware takes the files hostage, it forces the victim to pay the perpetrator to unlock the files. It may be introduced to a victim's computer through spam emails with malicious links or file attachments, free file hosting websites, and Peer to Peer (P2P) networks.
When the ransomware runs on a user's computer, it encrypts files on the computer and adds the .dharma extension onto the names of the files. It also appends an [email@example.com] or [firstname.lastname@example.org] email address with the extension. The types of files typically targeted include spreadsheets, documents, images, videos, and backup files, such as .DOCX, .PDF, .JPG, .AVI, and .DB files. For example, a spreadsheet.xlsx file becomes spreadsheet.xlsx.[email@example.com].dharma or spreadsheet.xlsx.[firstname.lastname@example.org].dharma.
The virus then generates a README.txt file in each folder that stores an encrypted file on the user's computer. The README.txt file contains brief instructions explaining the hostile takeover of the user's files and how the user can recover his files by paying a ransom payment.
How do I recover my files that have been encrypted by the Dharma virus?
Currently, there is no program available to effectively restore infected files. If the user has a recent backup of his files, he can perform a system restore to remove the virus but any changes made to files after the backup was made will be lost.