Do you know what Hakbit Ransomware is?
Hakbit Ransomware can encrypt .TXT, .JPEG, .GIF, .ZIP, .DOC, .PDF, and various other types of files. It does that using a unique algorithm that only the attackers know. At the time of research, malware experts had not cracked the algorithm, and so a free decryptor was not available. Hopefully, it will be released by the time you are reading this report, but we would not bet on it. Unfortunately, most file-encryptors remain undecryptable. Needless to say, if you do not have a reliable tool to fall back onto, you might decide that the solution offered by the attackers is the one you have to choose. You do not have to do anything, and if you continue reading the report, you will learn why obeying the demands of cybercriminals can be the biggest mistake. Of course, we also discuss the removal of Hakbit Ransomware.
Although Hakbit Ransomware can be spread in a number of different ways, researchers in our team inform that this malware is most likely to be spread via spam emails, downloaders, and unprotected RDP channels. These are the most common methods of distribution amongst ransomware, and this is how Kiss Ransomware, Li Ransomware, Erenahen Ransomware, Seto Ransomware, and hundreds of other threats alike spread too. Ultimately, Hakbit Ransomware is meant to slither in silently, so that it could encrypt your personal files without disturbance. It encrypts 82 different types of files across the system. Once it is done, the “.crypted” extension is added to the names, and while you might have a desire to remove this extension, keep in mind that this action will not restore your files. You need to address the data within.
Hakbit Ransomware screenshot
Scroll down for full removal instructions
Hakbit Ransomware drops a file named “wallpaper.bmp” in the %TEMP% directory. This file replaces the regular image file that is displayed as the Desktop wallpaper. Although it is an image file, it was created to deliver a text message. This message is identical to the one that you can find in the ransom note file called “HELP_ME_RECOVER_MY_FILES.txt.” This file is likely to be dropped someplace you can find it quickly. According to the ransom message, all files were encrypted, and now you need to pay a ransom of $300 to obtain a “Unique Identifier Key.” Allegedly, this is the key that would help you unlock your files. You are instructed to pay the ransom in BTC by sending it to 12grtxACJZkgT2nGAvMesgoM4ADHJ6NTaW. At the time of research, this wallet had 2 transactions of 0.05489 BTC, which is around $500. Quite possibly, someone was already pushed into paying the ransom. The note also includes an email address (hakbit@protonmail.com) that you can use to contact the attackers. You should not contact the attackers or pay the ransom, because you are unlikely to gain anything by doing that. On the contrary, you could expose yourself to new scams.
Although a fee decryptor did not exist at the time of research, the corrupted files could still be replaced using backups. Sadly, Hakbit Ransomware deletes shadow volume copies, and so if you use internal backup, you will not be able to replace files. If you use external or online backups, you are good to go. As for the removal of the infection, it looks like Hakbit Ransomware removes itself after execution, but some leftovers remain, and these leftovers must be eliminated. Our research team has created a simple guide that will, hopefully, make the manual removal easier. Of course, if you are worried about your system’s protection in the future, we advise installing anti-malware software to delete leftovers and protect Windows at the same time.
Remove Hakbit Ransomware
- Delete the ransom note file, HELP_ME_RECOVER_MY_FILES.txt.
- Simultaneously tap keys Win and E on the keyboard to launch Explorer.
- Enter %TEMP% into the field at the top and Delete the file named wallpaper.bmp.
- Enter %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup into the field at the top.
- Delete a malicious .exe file that is likely to have a name of a legitimate file (e.g., calc.exe, chrome32.exe, crcss.exe, ctfmom.exe, dllhst.exe, firefox.exe, lsass.exe, memop.exe, mysqld.exe, opera32.exe, SkypeApp.exe, spoolcv.exe, or svchst.exe).
- Empty Recycle Bin to complete the removal of all of these components.
- Install a malware scanner you trust and then perform a scan to check for potential leftovers.
In non-techie terms:
You might have let Hakbit Ransomware into your operating system yourself by accident, and that is something you need to learn from. If you continue to download strange files, open spam emails, and keep your operating system unguarded, you are likely to face new malicious infections again and again. This dangerous ransomware encrypts files, and if it succeeds, the files become unreadable, and decrypting them was not possible at the time of research. Although cybercriminals propose purchasing a decryptor, who can say that their promises to give you the tool in return are legitimate? It is most likely that you would find yourself empty-handed if you decided to pay the ransom. In the best case scenario, you have backups that can replace the corrupted files. Of course, replacements should be made after deleting Hakbit Ransomware. Since the main launcher erases itself, manual removal should not be difficult, but we suggest implementing anti-malware software anyway because this is the software that can provide you with reliable protection.