This article has been made to show how to remove Hermes 2.0 ransomware virus and restore files encrypted by this infection on your PC.
A new variant of HERMES ransomware has been detected out in the wild. The virus aims to encrypt the files on the systems infected by it, after which drops a ransom note, which is named “DECRYPT_INFORMATION.html” and “DECRYPT_INFO.txt”. The virus also generates unique decryption keys based on which files can be decrypted when the ransom is paid. In case you have become a victim of this ransomware infection we advise reading the following material.
Threat Summary
| Name | HERMES 2.0 | |
| Type | Ransomware | |
| Short Description | Encrypts files with RSA and AES ciphers after which demands victims to contact the cyber-criminals via Bitmessage mail. | |
| Symptoms | Upon infection the victim may see the files encrypted with an added HERMES suffix and the above-mentioned ransom notes dropped on their computers. | |
| Distribution Method | Via an Exploit kit, Dll file attack, malicious JavaScript or a drive-by download of the malware itself in an obfuscated manner. | |
| Detection Tool | See If Your System Has Been Affected by HERMES 2.0 Download Malware Removal Tool | |
| User Experience | Join our forum to Discuss HERMES 2.0. | |
| Data Recovery Tool | Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive. |
HERMES 2.0 Ransomware – Distribution Methods
The HERMES ransomware virus is reported by malware analysts to be spread via malicious e-mail spam messages. These messages may contain:
A malicious web link or a web link leading to the download of the infection file.
The infection file embedded as an attachment(document with malicious macros, executable, JavaScript file or other malicious executables).
Other methods by which HERMES 2.0 infection can occur are via the usage of malicious exploit kits, updates as well as infected installers, repackaged files and fake key generators or software activators. Such can be uploaded on torrent websites as well as websites that are risky. Such can be opened automatically by having a potentially unwanted program, causing redirections(https://sensorstechforum.com/remove-wowstart-online-redirect/) on your web browser.
HERMES File Virus – Infection Activity
When the user opens the infection file of the ransomware virus, it may connect to a remote host and drop the following files on the infected machine:
- Reload.exe
- system_.bat
- shade.bat
- DECRYPT_INFO.txt
- DECRYPT_INFORMATION.html
- UNIQUE_ID_DO_NOT_REMOVE
- hermes.exe
- shade.vbs
In addition to those files, the virus may also drop the following objects:
- Cversions.2.db
- Computer Management.lnk
- Multiple .db objects with random names, located in %Caches% directory.
Once an infection has happened, HERMES 2.0 ransomware may immediately begin to use the method Evelen to bypass the UAC service. Then, the virus may execute the following commands without the user noticing with the purpose to delete shadow copies:
→ process call create “cmd.exe /c
vssadmin.exe delete shadows /all /quiet
bcdedit.exe /set {default} recoveryenabled no
bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
The deletion of shadow copies, includes erasing files with the following file types:
→ .VHD .bac .bak .wbcat .bkf ,backup, .set, .win .dsk
After the virus has deleted the shadow copies, it may begin modifications in the Windows Registry Editor. These modifications may include attacking the run and run once windows keys with the following data:
→ HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run” /v “allkeeper” /t REG_SZ /d “%USERPROFILE%\Desktop\DECRYPT_INFORMATION.html” /f
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run” /v “sysrep” /t REG_SZ /d “%PUBLIC%\Reload.exe” /f
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run” /v “allkeeper” /t REG_SZ /d
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run” /v “sysrep” /t REG_SZ /d
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\allkeeper C:\users\User\Desktop\DECRYPT_INFORMATION.html
After the Reload.exe file has been ran, the ransomware virus begins the encryption process.
HERMES Encryption Process
The encryption process of HERMES 2.0 ransomware targets a lot of different file types to be encoded. The file extensions which are encrypted if detected by this ransomware virus are reported by malware researchers to be the following:
→ .accdb, .agif, .awdb, .bean, .cdmm, .cdmz, .cdr3, .cdr4, .cdr6, .cdrw, .clkw, .crwl, .ddoc, .djvu, .docm, .docx, .docz, .dotm, .dotx, .dtsx, .emlx, .epsf, .fdxt, .fh10, .fh11, .fodt, .fpos, .ft10, .ft11, .fwdn, .gdoc, .gfie, .glox, .gthr, .hpgl, .html, .icon, .idea, .itc2, .itdb, .jbig, .jpeg, .jpg2, .jrtf, .kdbx, .mbox, .mell, .mgcb, .mgmf, .mgmt, .mgmx, .mgtx, .mmat, .mobi, .mrxs, .pano, .pict, .pjpg, .pntg, .pobj, .pptm, .pptx, .psdx, .psid, .rctd, .reloc, .riff, .s2mv, .save, .scad, .sdoc, .smil, .ssfn, .sumo, .svgz, .text, .tiff, .utf8, .vrml, .vsdm, .vsdx, .vstm, .vstx, .wbmp, .webp, .wmdb, .xhtm, .xlgc, .xlsb, .xlsm, .xlsx, .zabw (700 more)
For the encryption process, this iteration of HERMES ransomware uses the file extension of it’s name and adds it without a separated, dot. Files appear like the following:
The encryption by HERMES 2.0 is performed with the assistance of two of the most sophisticated ciphers so far, the AES and RSA algorithms. The encryption process includes the encryption of the files via the AES cipher and then the RSA cipher appends an extra key to the files, unique for every infection.
After this has been completed, the private decryption information Is sent to the cyber-criminals and the second version leaves the following ransom note asking to contact the cyber-crooks via Bitmessage address:
Remove HERMES 2.0 Virus + File Recovery
The removal process of HERMES 2.0 ransomware should not begin if you haven’t set up any backup of your files first, even though they are likely encrypted.
After the backup is complete, it is strongly advisable to follow the removal instructions underneath and remove the HERMES virus files either manually or automatically. Security analysts also strongly advise victims to focus on removing the malicious files of Hermes ransomware with an anti-malware tool, which will also protect the system in real-time.
To restore files encrypted by HERMES virus, you can try the alternative file recovery tools in step “2. Restore files encrypted by HERMES”. They are not 100% effective but may help you until a decryptor for Hermes ransomware is released for free. We will update this post if other decryption methods appear, so we suggest checking it out from time to time and to keep the copies you backed up on a separate drive.
