Ransom.Win32.HDLOCKER.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other Details

This Ransomware does the following:

• encrypts available drives in the system
• only infects files within directories of available drives
• terminates if %Desktop%\HD_ransomware.log is being used in another process → basis to ensure only one copy of itself is running
• displays the following window after encryption:
  
  • Translation: "Gong Hi, you've been lured by me. If you have important documents to decrypt, please pay Bao 50 yuan."

Ransomware Routine

This Ransomware drops the following file(s) as ransom note:

• %Desktop%\HD_ransomware.log
   → also logs encrypted files
   → "ransomware" is written in Chinese
  
  Translation:
  • "Description: HDLocker_ if you want to decrypt the file to pay me 200W yuan,to decrypt contact QQ:"
  • "Key: {Characters}"
  • "Encrypting files : {Encrypted File}"
   → ends with the following text (in Chinese):
  • "You've been blackmailed by me. for decryption, please contact QQ111."

It avoids encrypting files with the following file extensions:

• lnk
• dll
• exe
• sys
• ttf
• _HD