HWABAG Ransomware Will Encrypt Your Files

Upon examining new malware samples, we have pinpointed HWABAG as a ransomware variant linked to the Dharma family. HWABAG functions by encrypting files, altering their names, and delivering two ransom notes: one via a pop-up window and another in the form of a "HWABAG.txt" file.

HWABAG alters file names by appending the victim's ID, cobson@hwabag.us email address, and the ".HWABAG" extension. For example, "1.jpg" becomes "1.jpg.id-9ECFA84E.[cobson@hwabag.us].HWABAG", and "2.png" changes to "2.png.id-9ECFA84E.[cobson@hwabag.us].HWABAG", and so forth.

The ransom note confirms the encryption of all files and advises the victim to initiate file restoration by posting a thread on a specified website, including an ID in the subject line. In the event of no response within 24 hours, the note directs the victim to contact the provided email address (cobson@hwabag.us).

Payment for decryption is requested in Bitcoins, with the amount depending on swift communication. Upon payment, a decryption tool is pledged. Additionally, the note offers complimentary decryption for up to 5 files of limited size and content. Lastly, it cautions against renaming encrypted files or using third-party software for decryption, as it may result in permanent data loss or increased costs.

HWABAG's Two Ransom Notes

The brief version of the ransom note generated by HWABAG inside the "HWABAG.txt" file reads as follows:

all your data has been turned into coal

You want to return?

post thread on this website hxxps://soyjak.party/raid/

If no answer in 24 hours write here: cobson@hwabag.us

The longer version that is displayed inside the pop-up window uses the usual Dharma template and goes as follows:

HWABAG!
All your files have been encrypted due you being pure NAS coal. If you want to restore them, post a thread on this website: hxxps://soyjak.party/raid/
Write this ID in the subject of your post: 9ECFA84E
In case of no answer in 24 hours contact us at this e-mail: cobson@hwabag.us
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files.
Free decryption as guarantee
Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 10Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
hxxps://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
hxxp://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

How Can Ransomware Like HWABAG Infect Your System?

Ransomware like HWABAG can infect your system through various means, often exploiting vulnerabilities or using deceptive tactics. Here are some common methods:

Phishing Emails: One prevalent method is through phishing emails containing malicious attachments or links. These emails may appear legitimate, often impersonating well-known companies or individuals, and trick users into clicking on the attachment or link, which then downloads and executes the ransomware.

Malicious Websites: Visiting compromised or malicious websites can also lead to ransomware infection. These websites may contain exploit kits that automatically download and install ransomware onto the visitor's system without their knowledge or consent.

Exploiting Vulnerabilities: Ransomware can exploit security vulnerabilities in software or operating systems to gain access to a system. Outdated software, unpatched systems, or lack of security updates can leave systems vulnerable to such attacks.

Malvertising: Malicious advertisements, or malvertisements, can redirect users to websites hosting ransomware or initiate automatic downloads of ransomware onto their systems without their interaction.

Drive-by Downloads: Ransomware can also be delivered through drive-by downloads, where malware is downloaded and installed onto a user's system without their knowledge or consent simply by visiting a compromised website.

Remote Desktop Protocol (RDP) Attacks: Attackers may exploit weak or default credentials for remote desktop connections to gain unauthorized access to systems and deploy ransomware.

Software Vulnerabilities: Vulnerabilities in software applications installed on a system can be exploited to execute ransomware. This includes vulnerabilities in commonly used software such as web browsers, office suites, or plugins.

To mitigate the risk of ransomware infection, it's essential to maintain up-to-date security measures such as using reputable antivirus software, regularly updating software and operating systems, being cautious of unsolicited emails or attachments, and implementing strong authentication methods for remote access. Additionally, regular backups of important data stored in secure locations can help mitigate the impact of a ransomware attack.