HexaCrypt Ransomware Encrypts Files and Threatens Public Exposure

A dangerous new malware strain named HexaCrypt has been spotted in the wild, encrypting victims’ files and demanding a cryptocurrency ransom under threat of publishing stolen data. This ransomware adds a unique twist by using a randomly generated string in its file extensions and ransom note, making detection and removal more difficult.

What Is HexaCrypt Ransomware?

HexaCrypt is a type of ransomware that targets and encrypts files on an infected system. It changes the original file names by appending a random string of characters to the extension. For example, a file like “1.jpg” becomes “1.jpg.5s48uq85,” and “2.png” turns into “2.png.5s48uq85.” At the same time, HexaCrypt creates a ransom note named with the same random string, such as “5s48uq85.READ_ME.txt.”

The purpose of this file is to deliver instructions to the victim and demand payment for file recovery.

What’s in the Ransom Note?

The ransom note explains that the victim’s files have been encrypted and exfiltrated. It states that only the attacker holds the decryption key and can restore access to the locked data. If the victim does not cooperate, the note warns that the decryption software will be deleted and the stolen data will be leaked publicly.

The attackers demand a payment of 450 US dollars in Bitcoin and provide a wallet address for the transaction. Victims are instructed to contact the attackers via hexacryptsupport(at)proton.me. The message also sets a strict 72-hour deadline to make the payment and establish communication.

The ransom note reads like the following:

All of your important files have been encrypted and stolen and only we can decrypt your files.
If you refuse to cooperate, your decryption software will be permanently deleted, and your stolen files will be published publicly.

Send 450$ worth of btc to this bitcoin wallet:
bc1qgngtzxgt3vcgx7andfl2temn3vt4unf5lmcqkj

contact us:
hexacryptsupport@proton.me

How Can You Trust Us?

If we do not provide the decryption tool after payment, no one will ever trust us again. We rely on our reputation.
To prove we can decrypt your files, you can send us 1 encrypted file.

You have 72 hours to pay and contact us.

Can Victims Recover Files Without Paying?

In most cases, victims are left with very limited options. Unless a third-party decryption tool becomes available or the user has a backup of their data, recovery is unlikely. Even if the ransom is paid, there is no guarantee that the attacker will actually deliver a working decryption key.

That’s why experts strongly advise against paying the ransom. Doing so not only supports criminal activity but also increases the chances of being targeted again in the future. Instead, victims should remove the ransomware as quickly as possible to prevent further encryption or lateral spread across a network.

How Does HexaCrypt Spread?

HexaCrypt, like many ransomware threats, can infect systems through multiple vectors. These include phishing emails with harmful attachments or embedded links, fake tech support messages, misleading ads, and compromised websites. Users often trigger the infection by opening a malicious file or clicking a deceptive link.

The ransomware may also be delivered through pirated software, key generators, cracked activation tools, software vulnerabilities, third-party downloaders, P2P file-sharing platforms, and infected USB drives. Common file types used in distribution include Word and PDF documents, scripts, executable files, ISO disk images, and ZIP archives.

How to Stay Safe from Ransomware Like HexaCrypt

Prevention is the most effective way to deal with ransomware threats. Here are several essential tips for minimizing your risk:

• Keep your operating system, applications, and security software updated at all times
• Run regular antivirus or anti-malware scans to detect potential threats early
• Avoid clicking links or opening attachments in emails from unknown or suspicious sources
• Download software and files only from trusted sources, such as official websites or verified app stores
• Be cautious of intrusive ads and never allow browser notifications from unreliable websites
• Avoid using pirated software or activation tools, which are often bundled with malware
• Maintain regular data backups on external storage devices or secure cloud services

If your computer is already infected with HexaCrypt, it is crucial to run a full system scan using a reliable anti-malware program to detect and remove the ransomware. Although this won’t restore encrypted files, it will prevent the malware from causing further damage.