HBM Ransomware is a New Dharma Clone Targeting Files to Encrypt

ransomware

Researchers discovered a new ransomware variant that belongs to the Dharma family of clones. The new version is called the HBM ransomware.

HBM encrypts documents, media files, archives and databases on the victim system's drives. Once files are encrypted, they go through a name change.

The HMB ransomware appends the victim's ID code, the email used by the ransomware operator and the ".HBM" string to the names of encrypted files. This means a file originally called "archive.zip" will turn into "archive.zip.id-VICTIM ID.[hebem@cock.li].HBM".

The ransomware generated a file called "info.txt" that contains a shorter version of the ransom note. A different, longer version is displayed in a pop-up window and reads as follows:

YOUR FILES ARE ENCRYPTED

DHARMA

Don't worry, you can return all your files!
If you want to restore them, write to the mail: hebem at cock dot li YOUR ID -
If you have not answered by mail within 12 hours, write to us by another mail:hebem at tuta dot io

ATTENTION!
We recommend you contact us directly to avoid overpaying agents

Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

November 30, 2022
Loading...

Cyclonis Backup Details & Terms

The Free Basic Cyclonis Backup plan gives you 2 GB of cloud storage space with full functionality! No credit card required. Need more storage space? Purchase a larger Cyclonis Backup plan today! To learn more about our policies and pricing, see Terms of Service, Privacy Policy, Discount Terms and Purchase Page. If you wish to uninstall the app, please visit the Uninstallation Instructions page.

Cyclonis Password Manager Details & Terms

FREE Trial: 30-Day One-Time Offer! No credit card required for Free Trial. Full functionality for the length of the Free Trial. (Full functionality after Free Trial requires subscription purchase.) To learn more about our policies and pricing, see EULA, Privacy Policy, Discount Terms and Purchase Page. If you wish to uninstall the app, please visit the Uninstallation Instructions page.