Blackhat ransomware virus - How to remove

Blackhat HFD ransomware virus is created according to an older ransomware infection, called MoWare HFD we investigated in May of 2017. After a little break, the same hackers return with a new sample, but the ransomware (What is ransomware?) is not well-prepared to be treated as a serious threat. This crypto-virus does not work properly and security researchers even had to solve several bugs to analyze this infection.

However, even the fixed version does not strike us as a sophisticated malware. In fact, it damages only those files that are found in the test folder on desktops. The same as its older version, Blackhat crypto-virus does not initiate a common routine of file-encryption. Instead, it is designed to retrieve XOR (XOR Encryption) key from a localhost web server. LockedByte is one of the examples of ransomware that use XOR.

All of these features suggest that no novel functions are included into the fresh variant. Hackers exploited the same strategy as they did during generation of MoWare HFD ransomware. Nevertheless, this is not the only version of this malware: there is also a variant from June, called CryptoGod.

Signs of an Blackhat HFD computer infection

Blackhat file-encoder will enter operating systems in secret, for instance, after exploit kits are put in motion. Users can stumble upon exploit kits when visiting domains that host them. Usually, devices, running on Windows, are threatened by ransomware samples. If you catch the virus we are discussing in this article, files in the test folder will be appended with a .H_F_D_locked extension. This indicates that a specific file is ruined by encryption and might not contain content it use to or might not open at all.

As usual, the crypto-virus requires a ransom: 200 dollars. Currently, this equals 0.06566 BTC which also indicates the payment system in which transactions have to be made. The fee is supposed to end up in 1LZnKJDsiygvLuYpbSJr1iyT6bav7VyWM5 bitcoin wallet and hackers might been 15-30 minutes to confirm the transaction as successful. Then, victims are expected to contact [email protected] email address and announce about the paid ransom.

Even though this ransomware is called Blackhat crypto-malware, its payload is named Blackbat.exe (Virus Total analysis). This file was investigated, and the analysis confirmed the association with MoWare H.F.D. The file was observed to make HTTP requests to Google.com and Google.fr (more specifically, Google.fr/?gfe_rd=cr&dcr=0&ei=Mfu3Wc6yIpD_8Ae104T4Dg).

This means that in order to function, infected computer has to be connected to the Internet for the attack to be successful. There are a lot of ransomware viruses that need Internet connection: Revenge and Mole samples. Nevertheless, the Blackhat ransomware is flawed and is currently failing to do any damage.

How to decrypt files and get rid of the ransomware infection?

If hackers release a more functional version of Blackhat ransomware, users might need to learn more about about the ways files can be decrypted. First of all, it is important to realize that the best solution would be to retrieve files form backup storages. However, not all people can enjoy this luxury since they did not upload their files into these utilities. Do this before it is too late and all of your data (or a part of it) becomes encrypted. If file-encryption takes place and you have not stored files in backup storages, then the situation becomes more complex.

Users can try to recover Shadow Volume Copies or try universal file-recovery tools that are created to help victims of many ransomware infections. However we cannot stress out enough the importance of removing ransomware form an operating system before any file-recovery techniques are exploited. If you restore digital data while ransomware is still present, the virus could re-encrypt executables. There is a strategy that should help people become immune to ransomware infections: storing files in alternative locations, having powerful anti-malware tools and avoiding spam letters, unknown websites and protecting RDP with strong passwords.

How to recover Blackhat ransomware virus encrypted files and remove the virus

Step 1. Restore system into last known good state using system restore

1. Reboot your computer to Safe Mode with Command Prompt:

for Windows 7 / Vista/ XP

• Start → Shutdown → Restart → OK.
• Press F8 key repeatedly until Advanced Boot Options window appears.
• Choose Safe Mode with Command Prompt.

for Windows 8 / 10

• Press Power at Windows login screen. Then press and hold Shift key and click Restart.
• Choose Troubleshoot → Advanced Options → Startup Settings and click Restart.
• When it loads, select Enable Safe Mode with Command Prompt from the list of Startup Settings.

 

2.Restore System files and settings.

• When Command Prompt mode loads, enter cd restore and press Enter.
• Then enter rstrui.exe and press Enter again.
• Click “Next” in the windows that appeared.
• Select one of the Restore Points that are available before Blackhat ransomware virus has infiltrated to your system and then click “Next”.
• To start System restore click “Yes”.

 

Step 2. Complete removal of Blackhat ransomware virus

After restoring your system, it is recommended to scan your computer with an anti-malware program, like Spyhunter and remove all malicious files related to Blackhat ransomware virus . You can check other tools here.  

Step 3. Restore Blackhat ransomware virus affected files using Shadow Volume Copies

If you do not use System Restore option on your operating system, there is a chance to use shadow copy snapshots. They store copies of your files that point of time when the system restore snapshot was created. Usually Blackhat ransomware virus tries to delete all possible Shadow Volume Copies, so this methods may not work on all computers. However, it may fail to do so. Shadow Volume Copies are only available with Windows XP Service Pack 2, Windows Vista, Windows 7, and Windows 8. There are two ways to retrieve your files via Shadow Volume Copy. You can do it using native Windows Previous Versions or via Shadow Explorer. a) Native Windows Previous Versions Right-click on an encrypted file and select Properties → Previous versions tab. Now you will see all available copies of that particular file and the time when it was stored in a Shadow Volume Copy. Choose the version of the file you want to retrieve and click Copy if you want to save it to some directory of your own, or Restore if you want to replace existing, encrypted file. If you want to see the content of file first, just click Open.

b) Shadow Explorer It is a program that can be found online for free. You can download either a full or a portable version of Shadow Explorer. Open the program. On the left top corner select the drive where the file you are looking for is a stored. You will see all folders on that drive. To retrieve a whole folder, right-click on it and select “Export”. Then choose where you want it to be stored.

Step 4. Use Data Recovery programs to recover Blackhat ransomware virus encrypted files

There are several data recovery programs that might recover encrypted files as well. This does not work in all cases but you can try this:

• We suggest using another PC and connect the infected hard drive as slave. It is still possible to do this on infected PC though.
• Download a data recovery program.
• Install and scan for recently deleted files.

Note: In many cases it is impossible to restore data files affected by modern ransomware. Thus I recommend using decent cloud backup software as precaution. We recommend checking out Carbonite, BackBlaze, CrashPlan or Mozy Home.