The number of Hermes 2.0 ransomware attacks proliferates after the initial Hermes version gets decrypted
Today we have a sample of Hermes 2.0 virus, which we are going to describe in a minute. It is common that once malware analysts manage to crack a ransomware and release a decrypter for it, a new version of the virus emerges shortly[1]. This is exactly what happened with Hermes ransomware virus – a malware analyst Fabian Wosar analyzed a sample of Hermes and demonstrated how a decrypter is created[2]. The researcher released almost 4-hour length video[3] showing how he analyzed the virus behavior. It seems that Hermes ransomware authors have learned a thing or two from the video as well, as they rushed to release Hermes 2.0 malware shortly after Fabian’s video was publicized. The new ransomware version is improved, and it is unlikely that it will be easy to reverse this one. Just like the previous version, it seeks to collect ransoms; however, we highly recommend you not to pay it (in case this virus manages to intrude into your PC system) and remove Hermes 2.0 virus using a reliable malware removal tool such as FortectIntego or MalwarebytesMalwarebytes.
Hermes 2.0 ransomware is written in C++ language[4]. After invading the computer system, it encrypts files using an RSA-2048 algorithm and puts some information in a file called DECRYPT_INFORMATION.html, which it saves on the desktop and possibly some other locations in the computer system. This .html file is actually a ransom note, which cybercriminals create only to deliver information on how the victim can recover his/hers files. The ransomware also creates a file called UNIQUE_ID_DO_NOT_REMOVE, which holds victim’s unique ID number. After completing these tasks, the ransomware deletes Volume Shadow Copies[5] by running this command: vssadmin Delete Shadows /all /quietvssadmin.
The virus doesn’t inform the victim about the version of the virus – just like the previous virus, it displays HERMES RANSOMWARE at the top of the ransom note. The virus asks to contact ransomware authors via email and suggests sending them three encrypted files, which criminals “kindly” suggest decrypting because they want to convince the victim that their decryptor works. Remember that such frauds will do everything to convince you to pay them, but do not expect to get anything in return! Cyber criminal can just simply take your money and make off. Their aim is to convince you to pay, not to care about you after you pay the ransom fee. Therefore, we suggest you think about Hermes 2.0 removal because as long as it stays in the system, it becomes much more vulnerable to further computer threats.
How did Hermes 2.0 virus get into my PC?
Hermes 2.0 ransomware is likely to be distributed using traditional ransomware distribution techniques – you can get this virus via email or alongside an illegal download, so think twice before opening that email attachment sent to you by a stranger or executing keygens and other programs designed to bypass paid software registration. Cyber criminals definitely know what files or programs engage victims’ attention, so they will do their best trying to provide you with them. Be very careful because criminals might try to impersonate employees of Amazon, Paypal, or even healthcare organizations just to trick you into opening a malicious email attachment that they send out to thousands of computer users. If you opened a questionable email attachment recently, it could be the reason why Hermes malware contaminated your PC. Please, be aware of general ransomware distribution techniques and do not let cyber criminals deceive you ever again!
Hermes 2.0 removal tutorial
Although Hermes ransomware used to be a fearsome virus and despite the fact that it wasn’t that powerful (if compared to other ransomware viruses such as Locky or Cerber), you should not stop applying security patches to your computer system. As you can see, a new version of the ransomware was released, and if you are reading this line at the moment, it is likely that you are looking for instructions on how to remove Hermes 2.0 virus. Our team recommends installing and continuously updating FortectIntego software because we believe it is one of the top anti-malware programs nowadays, which can help you with Hermes 2.0 removal. Before you let anti-malware program to do its job, run the computer in Safe Mode with Networking first.
Was this guide helpful?
4 comments