HomeinetHC7 Planetary: New variant of the well-known ransomware has appeared

HC7 Planetary: New variant of the known ransomware appeared

A new variant of the HC7 Ransomware has appeared on the Internet that encrypts user files and adds the .PLANETARY extension to their name. What makes this ransomware variant unique is that it is the first to accept Ethereum Coin as payment to unlock your files. HC7

Almost all ransomware use Bitcoin for their payment except a few that demand Monero. Now that Ethereum is selling above $1,200 each, its popularity is increasing and therefore we may start seeing it more often as a payment method in encrypted files from ransomware.

As for the HC7 Planetary variant, we know that it is currently being distributed through its programmer who “breaks” networks via some remote connection. Once it gains access to them, it then transfers the ransomware to all PCs it can access. After they are infected, the programmer allows the victim to decrypt their files once the corresponding ransom is paid. One computer (700$) or the entire network (5000$).

In the past, a specific procedure was followed to decrypt the encrypted HC7 files. Using the memory forensic method on the victim's computer, the password used in the command line during the ransomware installation could be recovered. However, the chances of success of this method decrease as the computer is used more and drop to zero if the computer is rebooted.

Although no other ransomware currently uses Ethereum and its easy payment process, in the future, it is not excluded that cryptocurrencies similar to it will be used.

 

📧
Subscribe to the SecNews Newsletter

The most important Security & Technology news in your Inbox.

SecNews
SecNewshttps://www.secnews.gr
In a world without fences and walls, who needs Gates and Windows

SEARCH

FOLLOW US

📧
Newsletter SecNews
The most important Security & Technology news in your inbox.

LIVE NEWS