Honkai Ransomware is a New Paradise Clone Looking for Files On Your PC to Encrypt
During a review of new entries on threat databases, we stumbled upon the Honkai ransomware, which belongs to the Paradise ransomware family. Upon conducting a test run of the Honkai ransomware, it was found that the malware encrypted files and altered their names.
The original file names were supplemented with a special identifier assigned to the victim, the cybercriminals' email address, and a ".honkai" extension. For instance, a file named "1.jpg" would appear as "1.jpg[id-f48tSVGB].[main@paradisenewgenshinimpact.top].honkai".
Following that, the ransomware dropped a ransom note labeled "#DECRYPT MY FILES#.html" onto the desktop. This message stated that the victim's files had been encrypted and that they would have to pay an undisclosed sum, which would increase if they delayed contacting the cybercriminals. Payment was to be made in Bitcoin cryptocurrency. However, the victims were allowed to test the decryption process on three files (under specific conditions) before paying.
The note ended with warnings, informing the victim that any attempts to rename the encrypted files, use third-party decryption tools, run anti-virus software, or remove the ransomware would lead to permanent data loss. The message also stated that the decryption keys from other victims would not work, as each ransomware attack employs unique encryption keys.
Table of Contents
The Honkai ransom demands
The full ransom note generated by the Honkai ransomware reads as follows:
Your files are encrypted!
Paradise Ransomware Team!Your personal ID
Your personal KEY
WHAT HAPPENED!
Your important files produced on this computer have been encrypted due a security problem.
If you want to restore them, write to us by email.
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us.
After payment we will send you the decryption tool that will decrypt all your files.FREE DECRYPTION AS GUARANTEE!
Before payment you can send us 1-3 files for free decryption.
Please note that files must NOT contain valuable information.
The file size should not exceed 1MB.
As evidence, we can decrypt one fileHOW TO OBTAIN BITCOINS!
Our Bitcoin Address: 392vKrpVxMF7Ld55TXyXpJ1FUE8dgKhFiv
The easiest way to buy bitcoin is LocalBitcoins site.
You have to register, click Buy bitcoins and select the seller by payment method and price
hxxps://localbitcoins.com/buy_bitcoins/
Also you can find other places to buy Bitcoins and beginners guide here:
hxxp://www.coindesk.com/information/how-can-i-buy-bitcoins/
write to Google how to buy Bitcoin in your country?Contact!
e-mail:
main@paradisenewgenshinimpact.top
or
e-mail:
main@paradisenewgenshinimpact.topAttention!
Do not rename encrypted files
Do not try to decrypt your data using third party software, it may cause permanent data loss
You are guaranteed to get the decryptor after payment
As evidence, we can decrypt one file
Do not attempt to use the antivirus or uninstall the program
This will lead to your data loss and unrecoverable
Decoders of other users is not suitable to decrypt your files - encryption key is unique
What is the best way to protect your files and data from ransomware attacks?
The best way to protect your files and data from ransomware attacks is to follow these steps:
- Keep software and operating systems up-to-date with the latest security patches.
- Use anti-virus software and keep it updated.
- Back up important data regularly on an external hard drive or cloud storage, and keep it offline.
- Be cautious when opening emails, especially those from unknown or suspicious senders. Do not open attachments or click on links from these sources.
- Avoid downloading software and files from untrusted websites and peer-to-peer networks.
- Enable user account control (UAC) on Windows systems to prevent unauthorized changes.
- Limit user permissions and disable macros in Office files.
- Disable Remote Desktop Protocol (RDP) unless necessary and ensure strong passwords are used.
Why can’t you restore your files if you become a victim of a ransomware similar to Honkai? don’t use bullets
If you become a victim of a ransomware similar to Honkai, you may not be able to restore your files for several reasons. Firstly, the malware encrypts your files and changes their names, making it difficult for you to access them. Secondly, the cyber criminals behind the attack usually demand a ransom payment in exchange for the decryption keys, which are necessary to restore your files.
However, there is no guarantee that you will receive the decryption keys even after paying the ransom. Additionally, the ransom note usually warns that attempting to restore the files using third-party decryption tools, running anti-virus software, or removing the malware will result in permanent data loss. This is because each attack employs unique encryption keys, which makes it difficult to restore the files without the decryption keys. Therefore, it is crucial to follow best practices for protecting your data and files to minimize the risk of falling victim to a ransomware attack.
