A ransomware infection, known as HERMES ransomware has been detected by malware researchers to heavily modify computer settings and encrypt the files using an AES encryption algorithm to render files on the compromised machine no longer able to be opened. The virus also ads it’s distinctive HERMES file extension to the encrypted files and then leaves an .html file which is named DECRYPT_INFORMATION.html. In case you have become an unfortunate victim of this ransomware infection, advices are to read this article and learn how to remove this virus and restore encrypted files.
|Short Description||The malware encrypts users files using a strong AES encryption algorithm, making direct decryption possible only via a unique decryption key available to the cyber-criminals.|
|Symptoms||The user may witness ransom notes and “instructions” called DECRYPT_INFORMATION.html linking to a web page and a decryptor. Changed file names and the file-extension HERMES has been used.|
|Detection Tool|| See If Your System Has Been Affected by Hermes |
Malware Removal Tool
|User Experience||Join our forum to Discuss Hermes.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
Hermes Ransomware – How Is It Spread
This particular virus uses malicious e-mail spam campaigns to spread either malicious web links or malicious executable files that cause the infection. The e-mails are accompanied by multiple deceptive messages that aim for one thing only – to convince potential victims to open the attachment. The attachments may be Microsoft Office documents or Adobe Reader files with malicious macros. But they may also be direct executable files such as:
To learn how to protect yourself from malicious e-mails, we advise visiting the following related article:
Hermes Ransomware – Post-Infection Analysis
After the user becomes infected by opening the malicious e-mail attachment, there is no going back from this. The ransomware drops it’s malicious files amongst which is the hermes.exe file which is responsible for the file encryption procedure. Then, the virus may heavily modify the Windows Registry Editor with the one and only purpose of doing this is to run the malicious executable every time Windows starts up. There are many sub-keys that may be targeted by Hermes ransomware, but the primary ones are the Run and RunOnce sub-keys, located in the following keys:
After it’s preparation phase is over, the Hermes virus may begin to encrypt files on the compromised computer. To encode files, the virus uses several different configuration settings of pre-set file types to corrupt. The files targeted by Herpes ransomware are often used by everyone and may be the following:
→ “PNG .PSD .PSPIMAGE .TGA .THM .TIF .TIFF .YUV .AI .EPS .PS .SVG .INDD .PCT .PDF .XLR .XLS .XLSX .ACCDB .DB .DBF .MDB .PDB .SQL .APK .APP .BAT .CGI .COM .EXE .GADGET .JAR .PIF .WSF .DEM .GAM .NES .ROM .SAV CAD Files .DWG .DXF GIS Files .GPX .KML .KMZ .ASP .ASPX .CER .CFM .CSR .CSS .HTM .HTML .JS .JSP .PHP .RSS .XHTML. DOC .DOCX .LOG .MSG .ODT .PAGES .RTF .TEX .TXT .WPD .WPS .CSV .DAT .GED .KEY .KEYCHAIN .PPS .PPT .PPTX ..INI .PRF Encoded Files .HQX .MIM .UUE .7Z .CBR .DEB .GZ .PKG .RAR .RPM .SITX .TAR.GZ .ZIP .ZIPX .BIN .CUE .DMG .ISO .MDF .TOAST .VCD SDF .TAR .TAX2014 .TAX2015 .VCF .XML Audio Files .AIF .IFF .M3U .M4A .MID .MP3 .MPA .WAV .WMA Video Files .3G2 .3GP .ASF .AVI .FLV .M4V .MOV .MP4 .MPG .RM .SRT .SWF .VOB .WMV 3D .3DM .3DS .MAX .OBJ R.BMP .DDS .GIF .JPG ..CRX .PLUGIN .FNT .FON .OTF .TTF .CAB .CPL .CUR .DESKTHEMEPACK .DLL .DMP .DRV .ICNS .ICO .LNK .SYS .CFG”Source:fileinfo.com
The virus may also connect to various domains to send information about the unlock key of the encrypted files. Hermes not only uses the AES encryption algorithm but the malware also ads its HERMES file extension to the files which are no longer openable. They may look like the following:
The Herpes ransomware does not stop it’s terror there. It also has to make sure the victim is made known of its presence. The malware leaves behind a DECRYPT_INFORMATION.html file which contains the ransom instructions. The file looks like the following when opened:
Remove Hermes Ransomware and Restore Encrypted Files
For the removal of Hermes ransomware, advices are to follow the instructions below. In case you lack the experience to perform the removal manually, experts always recommend using an advanced anti-malware program. Such software will also make sure that your system is protected in the future, besides removing Hermes virus completely.
After the removal of the virus, advices are to take into consideration multiple other options to restore your files, several of which we have mentioned in the removal instructions below in step “2. Restore files encrypted by Hermes” below.