Threat Database Ransomware HydraCrypt Ransomware

HydraCrypt Ransomware

By GoldSparrow in Ransomware

Threat Scorecard

Threat Level: 100 % (High)
Infected Computers: 15
First Seen: February 4, 2016
Last Seen: March 13, 2021
OS(es) Affected: Windows

The HydraCrypt Ransomware is a Trojan that is used by con artists to lock the data of infected users and demand payment for the release of a decryption key. The HydraCrypt cryptomalware is deployed to users using the Angler Exploit Kit, which is loaded on a remote server. Several compromised sites are known to propagate the HydraCrypt Ransomware among which are Drivers-softprotect.eu, Vyetbr.tk and Harbourfrontcentre.com. Many infections with the HydraCrypt Ransomware are facilitated with the Botime Trojan-Dropper that might plant the executable of the HydraCrypt Ransomware in the System32 folder under the Windows directory. Malware researchers note that the HydraCrypt Ransomware is relatively simple in behavior and is similar to the Buddy Ransomware. Once the user has been infected with the HydraCrypt Trojan, it would register itself to be run on the next system boot up. The encryption process would run in the background while the user is surfing the Internet and playing games.

Files that are encrypted by the HydraCrypt Ransomware would feature an icon that is a blank sheet of paper and has the .HYDRACRPT file extension. Additionally, the .HYDRACRPT suffix is followed by an identifier that is unique to each infected user. For example, the file Family_Reunion.JPG is going to be encrypted according to the model .hydracrypt_ID_. Victims of the HydraCrypt Ransomware are given seventy-two hours to contact the handles of the HydraCrypt Ransomware via email and pay the ransom. The email address can be found in a TXT file named README_DECRYPT_HYDRA_ID_ that is placed in every folder containing the .HYDRACRYPT files inside. Computer users are not advised to pay the ransom to the handlers of the HydraCrypt cryptomalware to discourage the development of that sort of software. Also, users have absolutely no guarantee that they will receive the decryption key for their data. A better choice is to use a backup solution to protect your files from accidental deletion and cryptomalware. You should keep your software up-to-date and employ the services of a trusted anti-malware application to prevent the infiltration of the HydraCrypt Ransomware.

SpyHunter Detects & Remove HydraCrypt Ransomware

File System Details

HydraCrypt Ransomware may create the following file(s):
# File Name MD5 Detections
1. HydraCrypt.exe 08b304d01220f9de63244b4666621bba 4
2. file.exe 7469c1ee0827a289fa775f4a5656e5f9 3
3. file.exe 5f2d13576e4906501c91b8bf400e0890 0

Trending

Most Viewed

Loading...