What is Hardbit virus?
The renaming will be executed according to the following pattern: [id-xxxxxxx].[contact_email].hardbit. In the process of encryption, a file entitled, for example, “report.docx” will be altered to “report.docx.[id-GSD557NO60].[].hardbit”.
In each folder containing the encoded files, a How To Restore Your Files.txt text document will be found. It is a ransom money note. Therein you can find information about the ways of paying the ransom and some other information. The ransom note most probably contains a description of how to purchase the decryption tool from the ransomware developers. You can get this decryptor after contacting through email. That is it.
| Name | Hardbit Virus |
| Extension | .hardbit |
| Ransomware note | How To Restore Your Files.txt |
| Contact | |
| Detection1 | Ransom:Win32/StopCrypt.ST!MTB, NSIS:AdwareX-gen [Adw], Ransom:Win32/StopCrypt.SS!MTB |
| Symptoms | Your files (photos, videos, documents) have a .hardbit extension and you can’t open them. |
| Fix Tool | See If Your System Has Been Affected by Hardbit virus |
The How To Restore Your Files.txt file coming in package with the Hardbit malware states the following:
_ _ _____ ___ ___ ___ _ _____ | | ( )| _ || _ \\ ( _ \\ ( _ \\ (_)(_ _) | |_| || (_) || (_) )| | ) || (_) )| | | | | _ || _ || / | | | || _ ( | | | | | | | || | | || |\\ \\ | |_) || (_) )| | | | (_) |_||_| |_||_| (_)(____/ (____/ |_| |_| ¦¦¦¦¦HARDBIT RANSOMWARE¦¦¦¦¦ ---- what happened? All your files have been stolen and then encrypted. But don\'t worry, everything is safe and will be returned to you. ---- How can I get my files back? You have to pay us to get the files back. We don\'t have bank or paypal accounts, you only have to pay us via Bitcoin. ---- How can I buy bitcoins? You can buy bitcoins from all reputable sites in the world and send them to us. Just search how to buy bitcoins on the internet. Our suggestion is these sites. >>hxxps:// ---- How will the payment process be after payment? After payment, we will send you the decryption tool along with the guide and we will be with you until the last file is decrypted. ---- What happens if I don\'t pay you? If you don\'t pay us, you will never have access to your files because the private key is only in our hands. This transaction is not important to us, but it is important to you, because not only do you not have access to your files, but you also lose time. And the more time passes, the more you will lose and If you do not pay the ransom, we will attack your company again in the future. ---- What are your recommendations? - Never change the name of the files, if you want to manipulate the files, make sure you make a backup of them. If there is a problem with the files, we are not responsible for it. - Never work with intermediary companies, because they charge more money from you. For example, if we ask you for 50,000 dollars, they will tell you 55,000 dollars. Don\'t be afraid of us, just call us. ---- Very important! For those who have cyber insurance against ransomware attacks. Insurance companies require you to keep your insurance information secret, this is to never pay the maximum amount specified in the contract or to pay nothing at all, disrupting negotiations. The insurance company will try to derail negotiations in any way they can so that they can later argue that you will be denied coverage because your insurance does not cover the ransom amount. For example your company is insured for 10 million dollars, while negotiating with your insurance agent about the ransom he will offer us the lowest possible amount, for example 100 thousand dollars, we will refuse the paltry amount and ask for example the amount of 15 million dollars, the insurance agent will never offer us the top threshold of your insurance of 10 million dollars. He will do anything to derail negotiations and refuse to pay us out completely and leave you alone with your problem. If you told us anonymously that your company was insured for $10 million and other important details regarding insurance coverage, we would not demand more than $10 million in correspondence with the insurance agent. That way you would have avoided a leak and decrypted your information. But since the sneaky insurance agent purposely negotiates so as not to pay for the insurance claim, only the insurance company wins in this situation. To avoid all this and get the money on the insurance, be sure to inform us anonymously about the availability and terms of insurance coverage, it benefits both you and us, but it does not benefit the insurance company. Poor multimillionaire insurers will not starve and will not become poorer from the payment of the maximum amount specified in the contract, because everyone knows that the contract is more expensive than money, so let them fulfill the conditions prescribed in your insurance contract, thanks to our interaction.
In the image below, you can see what a directory with files encrypted by the Hardbit looks like. Each filename has the “.hardbit” extension added to it.
How did my machine catch Hardbit ransomware?
There are currently three most popular methods for evil-doers to have the Hardbit virus settled in your digital environment. These are email spam, Trojan injection and peer networks.
If you open your inbox and see letters that look like familiar notifications from utility services providers, postal agencies like FedEx, Internet providers, and whatnot, but whose addresser is unknown to you, be wary of opening those letters. They are most likely to have a malicious item attached to them. So it is even riskier to open any attachments that come with letters like these.
Another option for ransom hunters is a Trojan file scheme2. A Trojan is a program that gets into your computer disguised as something different. For example, you download an installer for some program you need or an update for some service. However, what is unboxed turns out to be a harmful program that compromises your data. Since the update file can have any title and any icon, you’d better be sure that you can trust the resource of the stuff you’re downloading. The optimal thing is to use the software companies’ official websites.
As for the peer file transfer protocols like torrents or eMule, the threat is that they are even more trust-based than the rest of the Web. You can never guess what you download until you get it. So you’d better be using trustworthy websites. Also, it is reasonable to scan the directory containing the downloaded items with the antivirus as soon as the downloading is finished.
