Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Register a free account to unlock additional features at BleepingComputer.com

Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Latest News: NSA shares zero-trust guidance to limit adversaries on the network

Featured Deal: Enjoy quick, compatible data transfers with this $59.99 portable SSD

Latest Buyer's Guide: Hotspot Shield VPN review

HsHarada/Rapture Ransomware ([random 6 chars]; -README.txt) Support Topic

Started by Adha , Apr 06 2023 05:26 PM

Prev

Please log in to reply

37 replies to this topic

#31 quietman7

Bleepin' Gumshoe

Global Moderator
61,818 posts
OFFLINE

Gender:Male
Location:Virginia, USA
Local time:12:08 AM

Posted 10 January 2024 - 03:11 PM

Is tTp88O--README.txt the name of your ransom note? If so, then you most likely are dealing with HsHarada Ransomware (Rapture Ransomware) which uses a random 6 character alpha-numerical extension appended to the end of the encrypted data filename and typically will leave ransom notes which include the same [random 6 character]-README.txt (a "hard-coded 6 character string") as part of its name.

.
.
Microsoft MVP Alumni 2023, Windows Insider MVP 2017-2020, MVP Reconnect 2016-2023

Microsoft MVP Consumer Security 2007-2015
Member of UNITE, Unified Network of Instructors and Trusted Eliminators
Retired Police Officer, Federal Agent and Coast Guard Chief

If I have been helpful & you'd like to consider a donation, click

Back to top"> Back to top

BC AdBot (Login to Remove)

BleepingComputer.com
Register to remove ads

#32 rivitna

Security Colleague
185 posts
OFFLINE

Gender:Male
Local time:08:08 AM

Posted 10 January 2024 - 03:13 PM

Yes, it's HsHarada Ransomware.

https://github.com/rivitna/Malware/blob/main/HsHarada/attackers.txt

Edited by rivitna, 10 January 2024 - 03:15 PM.

Back to top"> Back to top

#33 alvi1903

Members
3 posts
OFFLINE

Local time:09:08 AM

Posted 10 January 2024 - 03:19 PM

Yes, you are right, it is the same virus, so how can I recover all my files? If you help me with this, I can donate $200 crypto for you.

Is tTp88O--README.txt the name of your ransom note? If so, then you most likely are dealing with HsHarada Ransomware (Rapture Ransomware) which uses a random 6 character alpha-numerical extension appended to the end of the encrypted data filename and typically will leave ransom notes which include the same [random 6 character]-README.txt (actually a "hard-coded 6 character string" as part of its name.

Back to top"> Back to top

#34 quietman7

Bleepin' Gumshoe

Global Moderator
61,818 posts
OFFLINE

Gender:Male
Location:Virginia, USA
Local time:12:08 AM

Posted 10 January 2024 - 03:23 PM

There is no known method that I am aware of to decrypt files encrypted by HsHarada Ransomware without paying the ransom (not advisable) and obtaining the private encryption keys from the criminals who created the ransomware unless they are leaked or seized & released by authorities. Without the criminal's master private key that can be used to decrypt your files, decryption is impossible. That usually means the key is unique (specific) for each victim and generated in a secure way (RSA, AES, Salsa20, ChaCha20, ECDH, ECC) that cannot be brute-forced...the public key alone that encrypted files is useless for decryption...the public key alone that encrypted files is useless for decryption.

.
.
Microsoft MVP Alumni 2023, Windows Insider MVP 2017-2020, MVP Reconnect 2016-2023

Microsoft MVP Consumer Security 2007-2015
Member of UNITE, Unified Network of Instructors and Trusted Eliminators
Retired Police Officer, Federal Agent and Coast Guard Chief

If I have been helpful & you'd like to consider a donation, click

Back to top"> Back to top

#35 quietman7

Bleepin' Gumshoe

Global Moderator
61,818 posts
OFFLINE

Gender:Male
Location:Virginia, USA
Local time:12:08 AM

Posted 10 January 2024 - 03:26 PM

@alvi1903

I have merged your topic into the primary support topic for victims of this ransomware.

.
.
Microsoft MVP Alumni 2023, Windows Insider MVP 2017-2020, MVP Reconnect 2016-2023

Microsoft MVP Consumer Security 2007-2015
Member of UNITE, Unified Network of Instructors and Trusted Eliminators
Retired Police Officer, Federal Agent and Coast Guard Chief

If I have been helpful & you'd like to consider a donation, click