Hhoo Ransomware Joins Host of Djvu Clones Targeting Files for Encryption

Our team discovered a new variant of ransomware belonging to the Djvu family called Hhoo while analyzing malware samples submitted to online threat analysis databases.

Hhoo encrypts files and modifies the filenames by adding a new extension (".hhoo") to the original file name. For example, "1.jpg" would become "1.jpg.hhoo," "2.png" would become "2.png.hhoo," and so on. Furthermore, Hhoo generates a ransom note named "_readme.txt". It's important to note that ransomware strains related to the Djvu family are frequently distributed along with other infostealers.

Upon investigating the ransom note, we discovered that its purpose is to provide the victim with details on how to make contact with the attackers and make a partial payment. The "_readme.txt" file contains two email addresses - support@freshmail.top and datarestorehelp@airmail.cc - and two different ransom amounts - $980 and $490. The note specifies that the victim can obtain the decryption tools (software and key) at a reduced rate if they contact the attackers within 72 hours.

Table of Contents

The Hhoo Ransom Note Asks for Nearly a Thousand in Ransom

The complete text of the ransom note file generated by the Hhoo ransomware reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-UQkYLBSiQ4
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How is Ransomware Similar to Hhoo Usually Spread?

Ransomware strains belonging to the Djvu family, like Hhoo, are typically distributed through various methods such as spam email campaigns, malvertising, software cracks, fake updates, and software bundles. These methods are designed to trick the victim into downloading and executing the ransomware onto their system. As mentioned in the original text, it's also worth noting that ransomware strains related to the Djvu family are frequently distributed along with other stealers like RedLine or Vidar, which can help the attackers gather additional sensitive information from the victim.

Therefore, it is essential to be cautious when opening emails from unknown senders, downloading software from untrusted sources, and to keep your system up-to-date with the latest security patches and updates.