Dharma virus, unlike similar types of ransomware, does not change desktop background, but creates README.txt or Document.txt.[firstname.lastname@example.org].zzzzz files and places them in each folder with compromised files. Text files contain message stating that users have to pay the ransom using Bitcoins and amount is approximately $300-$500 depending on ransomware version. The private decryption key is stored on a remote server, and there currently impossible to break the encryption of the latest version.
This particular sample of Adobe Ransomware is, in fact, a continuation of STOP Ransomware family. This virus attacks files, that can be important for average user, like documents, photos, databases, music, enciphers them with AES encryption and adds .adobe (one “e” in the end) or .adobee (two “e”s in the end) extensions to affected files. This creates a mess, because there are several different ransomware families using this extension after encryption. All these viruses use different algorithms, however .adobe (.adobee is work in progress) files encrypted by STOP Ransomware can be deciphered using STOPDecrypter (provided below). Unlike previous versions, this one gives clear information about the cost of decryption, which is $980 (or $490 if it is paid within 72 hours). However, this is just a trick, to encourage people to pay the ransom. Often authors of the ransomware don’t send any decryptor. We recommend you to remove executables of STOP Ransomware and use decryption tools available for .adobe files.