The AV Remover is a working tool that goes through the familiar installation routine if it is executed. Software installation runs on a different instance than malware Software installation distracts from the ransomware’s activitiesįigure 5.

The user will see the ESET GUI onscreen, a distraction from Dharma’s malicious activities.įigure 4. When the self-extracting archive runs, Dharma starts encrypting files in the background and the ESET AV Remover installation begins. The ransomware uses this old ESET AV Remover installer, which appears unmodified based on initial scanning, to divert attention as it encrypts files on the victim’s device. Running the self-extracting archive (Defender.exe) Trend Micro identifies taskhost.exe as a file connected to the Dharma ransomware (detected as )įigure 2. The downloaded file is a self-extracting archive named Defender.exe, which drops the malicious file taskhost.exe as well as the installer of an old version of ESET AV Remover renamed as Defender_nt32_enu.exe. If a user clicks on the download link, they will be prompted for a password (provided in the email message) before getting the file.įigure 1. Typical of spam, the message pressures users into downloading a file.

New samples of Dharma ransomware show that it is still being distributed via spam mail. Trend Micro recently found new samples of Dharma ransomware using a new technique: using software installation as a distraction to help hide malicious activities. One high profile attack happened in November 2018 when the ransomware infected a hospital in Texas, encrypting many of their stored records luckily the hospital was able to recover from the attack without paying the ransom.

The Dharma ransomware has been around since 2016, but it has continued to target and successfully victimize users and organizations around the world.

Eset av remover tool