A new variant of Dharma ransomware masquerading as an ESET AV Remover Installer, to trick the users and to hide its malicious activities.

Dharma ransomware was first found in 2016, and it uses the AES-256 encryption, the ransomware primarily targets storage devices.

A new variant of Dharma ransomware distributed via spam emails, which urges the users to click on the links in the emails. If the user clicks on the link, it prompts for a password that provided in the Email.

Once the user inputs the password, the downloaded files are self-extracting archive named Defender[.]exe, which in turn drops taskhost[.]exe which is the malicious file, also the old version of the renamed ESET AV Remover Defender_nt32_enu[.]exe.

According to TrendMicro analysis, taskhost[.]exe is the file connected with the Dharma ransomware. “The ransomware uses this old ESET AV Remover installer, which appears unmodified based on initial scanning, to divert attention as it encrypts files on the victim’s device.”

It start it’s encryption process in the background once the ESET AV Remover installation begins. It uses ESET GUI onscreen to distract the user, and it processes the encryption in the backend.

The ransomware runs entirely as a separate instance from AV remover, even if the AV remover not executed, the ransomware will run. The AV remover process is to trick the users.

Dharma Ransomware about to encrypt the Following file extension.


Cybercriminals continue to follow various obfuscation techniques to lure the users, the new variant of Dharma ransomware indicates attackers upgrade old threats and use new techniques.

Indicators of Compromise


You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Also Read

Hackers Offered IoT Botnet as Service “TheMoon” : Botnet-as-a-Service

Hackers Exploiting ThinkPHP Vulnerability To Expand Hakai and Yowai Botnets

New Hacking Group Outlaw Distributing Botnet to Scan The Network & Perform 


Please enter your comment!
Please enter your name here