.{dresdent@protonmail.com}DDT Ransomware — How to Remove It

.{dresdent@protonmail.com}DDT Ransomware — How to Remove It

.{dresdent@protonmail.com}DDT Ransomware virus remove

The .{dresdent@protonmail.com}DDT ransomware is a new iteration of the Globe Imposter malware family seeking to infect as many users as possible. There is no information available about the hacking collective behind it at the moment. This may mean that the criminals may have taken the original Globe Imposter code and modified it to create the new virus or that they may have paid other groups on the dark markets for a custom version.

Popular methods include the coordination of email phishing messages that pose as legitimate notifications that have been sent in by well-known companies and services. They will contain fake or stolen content that will induce the virus infections by providing the dangerous files or links to them. A similar tactic is the creation of numerous malicious web sites which are hosted domains that sound familiar to well-known portals or services. The other approach is to embed the necessary code into web browser extensions which are often uploaded to their relevant repositories using fake user reviews and developer credentials.

Ransomware strains of this malware family are known to be spread by various file carriers that can be distributed by any of these sources. Common ones include the creation of malicious documents of all popular formats: spreadsheets, presentations, databases and text documents. The other type is the creation of malicious application installers — the criminal group will focus on software that is commonly acquired and installed by the users.

If the .{dresdent@protonmail.com}DDT ransomware follows the behavior pattern set by previous Globe Imposter strains then typical modules will be started. This can include data theft which will scan the infected computer for sensitive information. It may be used both to reveal the identity of the victims and assign an unique ID to the infected computers. This data can then be used further by another module used to bypass security applications if such are found running in memory or installed on the hard disk: anti-virus programs, firewalls, sandbox environments and virtual machine hosts.

Other consequences of having this threat installed include the following:

  • Windows Registry and System Changes — Such modifications can lead to dangerous modifications of the host operating system. This can lead to severe performance issues that can lead to problems when working with the computer, errors and loss of data.
  • Startup Options Modification — The .{dresdent@protonmail.com}DDT ransomware can be set to automatically start when the computer is powered on. This setting change cannot be reverted and the victims may not be able to access any recovery options.
  • Additional Malware Delivery — Globe Imposter ransomware strains can be used as conduits for other malware to the victim hosts: Trojans, miners and etc.

As soon as all components have finished running the actual file processing will begin. Using a strong cipher target user data will be encrypted and made unavailable to the computer users. This includes popular file types: documents, archives, databases, multimedia files, applications and etc. They will receive the .{dresdent@protonmail.com}DDT extension. An associate ransom note, wallpaper or lockscreen instance can be produced to blackmail the victims into paying the hackers a “decryption fee”.

Threat Summary

Name.{dresdent@protonmail.com}DDT Ransomware
TypeRansomware, Cryptovirus
Short DescriptionThe ransomware encrypts files on your computer machine and demands a ransom to be paid to allegedly restore them.
SymptomsThe ransomware will blackmail the victims to pay them a decryption fee. Sensitive user data may be encrypted by the ransomware code.
Distribution MethodSpam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by .{dresdent@protonmail.com}DDT Ransomware


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss .{dresdent@protonmail.com}DDT Ransomware.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

.{dresdent@protonmail.com}DDT Ransomware – What Does It Do?

.{dresdent@protonmail.com}DDT Ransomware could spread its infection in various ways. A payload dropper which initiates the malicious script for this ransomware is being spread around the Internet. .{dresdent@protonmail.com}DDT Ransomware might also distribute its payload file on social media and file-sharing services. Freeware which is found on the Web can be presented as helpful also be hiding the malicious script for the cryptovirus. Read the tips for ransomware prevention from our forum.

.{dresdent@protonmail.com}DDT Ransomware is a cryptovirus that encrypts your files and shows a window with instructions on your computer screen. The extortionists want you to pay a ransom for the alleged restoration of your files. The main engine could make entries in the Windows Registry to achieve persistence, and interfere with processes in Windows.

The .{dresdent@protonmail.com}DDT Ransomware is a crypto virus programmed to encrypt user data. As soon as all modules have finished running in their prescribed order the lockscreen will launch an application frame which will prevent the users from interacting with their computers. It will display the ransomware note to the victims.

You should NOT under any circumstances pay any ransom sum. Your files may not get recovered, and nobody could give you a guarantee for that.

The .{dresdent@protonmail.com}DDT Ransomware cryptovirus could be set to erase all the Shadow Volume Copies from the Windows operating system with the help of the following command:

→vssadmin.exe delete shadows /all /Quiet

If your computer device was infected with this ransomware and your files are locked, read on through to find out how you could potentially restore your files back to normal.

Remove .{dresdent@protonmail.com}DDT Ransomware

If your computer system got infected with the .{dresdent@protonmail.com}DDT Files ransomware virus, you should have a bit of experience in removing malware. You should get rid of this ransomware as quickly as possible before it can have the chance to spread further and infect other computers. You should remove the ransomware and follow the step-by-step instructions guide provided below.


Martin Beltov

Martin graduated with a degree in Publishing from Sofia University. As a cyber security enthusiast he enjoys writing about the latest threats and mechanisms of intrusion.

More Posts - Website

Follow Me:
TwitterGoogle Plus

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share