Ransom.MSIL.HOGLOCKER.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following mutexes to ensure that only one of its copies runs at any one time:

• 6950448537301897-Dropper-6950448537301897

Other Details

This Ransomware does the following:

• It connects to the following URL to download a resource:
  • https://discord.com/api/v8/invites/{BLOCKED}qh
  • It will not proceed with its intended routine if the resource does not contain the string "\", \"guild\": {"
• It enumerate files stored in the logical drives and the root directory where the Ransomware is installed
  • It will not proceed in encrypting the file if it ends with ".hog" extension
  • It will not proceed in encrypting the file if the byte size is greater than 26214400L
• It executes the following command to remove its traces on the system:
  • cmd.exe /C choice /C Y /N /D Y /T 1 & Del {Malware Path\Malware Name}.exe

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file path:

• C:\Windows

It appends the following extension to the file name of the encrypted files:

• .hog

It drops the following file(s) as ransom note:

• %User Startup%\DECRYPT-MY-FILES.exe
  • This ransom note contains the following text:
  
  

It avoids encrypting files with the following file extensions:

• .hog
• .exe
• .dll
• .ini
• .scr
• .sys
• .vmx
• .vmd