Dodged ransomware: what it is and how to remove it

From our report of May 2020 · not reviewed since

More from our earlier report on Dodged ransomware

• To eliminate the infection, you should scan your machine with a reputable security program, such as or
• After infection elimination, some changes made to the system previously might cause stability issues.
• If you experience lag, crashes, errors, and similar problems, utilize to fix them for you
• Dodged ransomware is a new strain that was deployed by unknown actors.

From our report of May 2020 · not reviewed since

Dodged ransomware is data locking malware that targets Italian users with COVID-19-themed phishing emails

Dodged ransomware is a data-locking malware sample that was spotted by MalwareHunterTeam, the prevalence of which is not defined yet.

However, security researchers pointed out that the infection mainly targets users in Italy, although the data redemption instructions are written in English. Also, the executable of Dodged ransomware that was seen in the sample came as COVID-20.exe, which is highly likely to stem from a coronavirus-themed phishing email.

Once inside the system, the Dodged virus begins to look for files to encrypt and then appends .dodged extension to each. It then delivers a pop-up window, which explains that victims should transfer $150 worth of Bitcoin via the onion page, accessible only via the Tor network.

However, you should avoid paying the ransom to cybercriminals, as chances of getting scammed are quite high. Instead, you should focus on Dodged ransomware removal and alternative methods for data recovery.

While there are no definite answers on how exactly Dodged ransomware is propagated, it is highly likely to be phishing spam emails that are sent to thousands of users thanks to tools like botnets. Nonetheless, there might be other methods the attackers may use, such as malicious ads, software vulnerabilities, drive-by downloads, software cracks, and many others.

Dodged ransomware is a strain that was deployed by unknown actors. However, it has several functionality features that suggest that the attackers are planning on making it into a larger campaign later.

The analysis shows that malware is equipped with anti-analysis features, which attempts to prevent the researchers from dissecting the sample in a sandbox or virtual machine environment. Typically, such malware exists without triggering the infection routine and performing other predetermined actions.

Besides this, Dodged ransomware is also capable of the following:

Typically, crypto-malware is programmed to encrypt files that are most commonly used, such as .pdf, .jpg, .doc, .zip, .mp4, and many others.

Currently, it is unknown which encryption method Dodged file virus is using to encrypt data. There are two different categories of encryption, symmetric (such as AES) and asymmetric (such as RSA). While the way these two mothers operate differ, it does not make much difference for victims, as they are unable to access their files afterward regardless.

Besides encrypting files, Dodged ransomware is currently programmed to delete some personal files as well. This feature is typical of wiper-type ransomware, so the threat seems to be a hybrid.

At the final stage of the attack, Dodged ransomware drops a ransom note, (it also contains a 3 hour timer, although it is unknown if it actually change anything after the expiration) which reads:

While the attacks cannot be trusted, they are correct about file alternation using recovery software, as it may damage encrypted data permanently. To avoid that, you should make a copy of your hard drive (encrypted files, registry database, etc.) and only then remove Dodged ransomware from the system, followed up by attempts to recover files in an alternative way.

• hides its tracks by altering the appearance of some files/folders on the infected system
• exhibits system monitoring features by tracking mouse movements
• creates a variety of malicious files and places them on the system
• removes certain user files from the system (wiper)
• deletes the shadow volume copies to prevent easy data recovery
• modifies Windows registry to establish persistence, etc.

From our report of May 2020 · not reviewed since

Spam emails - one of the most prominent malware distribution techniques

Ransomware is a lucrative business - there are experienced cybercriminal gangs operating some strains, while others are made by amateur hackers.

Nonetheless, both types can cause significant damage to users who get infected with malware, as they might permanently lose access to their files. This is because malware infection and file encryption are two different processes, although the latter is only possible after the former is executed.

Besides data locking, crooks now often leak the files before encrypting them to be able to threaten with public exposure - this is another extortion method that has been employed for a while now by major ransomware players, such as Maze, Sodinokibi, DoppelPaymer, and many others.

What makes the situation worse is the COVID-19 pandemic, as the criminals rush to abuse the global situation and the relevance of the topic. Many people are concerned and want to know as much as possible about the disease. For awhile now, cybersecurity researchers spotted multiple campaigns that target users and companies with coronavirus-themed phishing emails.

Typically, the attackers pretend to be from a reputable organization, such as World Health Organization or Centers for Disease Control and Prevention, as they use familiar logos, similar email addresses, social engineering, and other tactics.

These emails are equipped with an attachment, which can come in various formats, including .doc, .pdf, .vbs, .exe, .zip, and others. Once opened, these files begin the infection process of the computer, finalizing it with data encryption.

From our report of May 2020 · not reviewed since

Eliminate Dodged ransomware correctly

Many users are shocked or straight out confused as soon as they encounter ransomware.

Some are not even aware of what ransomware is, or what it does, so locked data becomes a mystery. In many cases, such users also believe that they can return their data with Dodged ransomware removal, which is not the case at all.

While many ransomware viruses automatically delete themselves after the encryption is performed, others tent to operate on the system even after the process is complete with locking the incoming files. Therefore, it is best to scan the machine with anti-malware software and remove Dodged ransomware, its secondary payloads, and malicious components. However, this process should not be done before a full backup of the hard drive is prepared.

Once malware is eliminated (in case the Dodged virus is tampering with your anti-malware software, access Safe Mode with Networking as explained below), you can attempt to recover your data with the help of instructions we provide below.

Unfortunately, there are no other safe methods to recover files currently, although security researchers might find bugs within malware's code that would help them create a free Dodged ransomware decryptor in the future.

[GI=method-1]To access Safe Mode with Networking, perform the following actions:

[GI=method-2]System Restore might also be used for Dodged malware removal:

Data recovery software does not attempt to decipher encrypted files, but rather recover working copies from the hard drive. The less you use your machine post-infection, the more chances there are for this method to work.

Make use of Windows Previous Versions feature

This method will only work if you had System Restore enabled prior to the infection, and the process is only applicable to separate files, and not data batches.

Employ ShaodwExplorer for data restoration

If you were lucky enough and Dodged ransomware failed to eliminate Shadow Volume Copies, use ShaodwExplorer to return your files.

No decryption tool is currently available