Thursday, June 13, 2024

Cyber Criminals Launch Hermes Ransomware Via Password Protected Word Documents

Cyber Criminals distributing Hermes Ransomware via dangerous malspam that contains Weaponized Password protected Word documents to encrypt the system files and lock the victim’s computer.

Hermes Ransomware Attack is wide spreading Ransomware nowadays with newly updated futures under constant development to target various countries.

Few Months Before attackers distributed Hermes ransomware through the flash exploit and attacks targetted on South Korean users.

Malware authors added many futures in newly evolved versions Ransomware such as change the method to get the Trojan key, algorithm, crypto-libraries and distribution method.

Also, they are using various obfuscation techniques to evade the detection of anti-virus software and maintain its persistance.

Currently discovered malicious word document protected with a password that shows a 1 / 59 detection rate in VirusTotal.

How does Hermes Ransomware Infection Works

Intially Hermes Ransomware distributed via malspam that claimes the job applications with malicious attached word documents.

Once user trying to open the documents, it keeps requesting the password to open the file and the password has mentioned within the mail body content with sending addresses ending in

After opening the document, a user asked to enable the macros with a security warning to proceed the malicious document to do further malicious activities.

According to SANS, After successfully opening the attached Word document and enabling macros, I only saw one HTTP request that returned a malware binary. This was Hermes ransomware, and it didn’t generate any post-infection traffic.

After completing the infection process, vicitms disk files will be completely encrypted and the ransom notes will be displayed on a desktop.

Ransom note indicates that the victim’s files are encrypted using  RSA2048 algorithm with a unique public key and the user asked to pay the ransom amount in bitcoin.

Also, infected users can test 1 file as a token decryption key and attacker provide a contact email [email protected] for further instructions.

Indicators for this infection

SHA256 hash: 4e5f6a6e8c073828af55c830fad5ce7496313083f42f5bc655c90a9a1314cbb2
File description: Password-protected Word doc with macro to retrieve malware

SHA256 hash: 8dcde14308b6a7edff44fa2ac0aa2e672104db6d35f37ac93452944323468e5e
File description: Follow-up malware – Hermes ransomware

Also Read

New Version of GandCrab Ransomware Attack via Compromised Websites using SMB Exploit Spreader

Hackers Distributing Malicious PDF that Perform both Ransomware and Crypto-Mining Attack

New Version of SamSam Ransomware Attack Targeted Victims with Sophisticated Evasion Techniques


Latest articles

Ivanti EPM SQL Injection Flaw Let Attackers Execute Remote Code

In May 24, 2024, Zero-Day Initiative released a security advisory for Ivanti EPM which...

CISA Warns of Scammers Impersonating as CISA Employees

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a surge...

Microsoft Windows Ntqueryinformationtoken Flaw Let Attackers Escalate Privileges

Microsoft has disclosed a critical vulnerability identified as CVE-2024-30088.With a CVSS score of 8.8, this flaw affects Microsoft...

256,000+ Publicly Exposed Windows Servers Vulnerable to MSMQ RCE Flaw

Cybersecurity watchdog Shadowserver has identified 256,000+ publicly exposed servers vulnerable to a critical Remote...

Indian National Jailed For Hacked Servers Of Company That Fired Him

An Indian national was sentenced to two years and eight months in jail for...

JetBrains Warns of GitHub Plugin that Exposes Access Tokens

A critical vulnerability (CVE-2024-37051) in the JetBrains GitHub plugin for IntelliJ-based IDEs (2023.1 and...

Critical Flaw In Apple Ecosystems Let Attackers Gain Unauthorized Access

Hackers go for Apple due to its massive user base along with rich customers,...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles