hyflock | 478ccc46a2b0207db57d7dae329d0dba4311500d928d8ee491116922504f6dd0

General

Target
478ccc46a2b0207db57d7dae329d0dba4311500d928d8ee491116922504f6dd0.bin
Size 1.7MB
Sample261110-l23lpaed93
SHA256 478ccc46a2b0207db57d7dae329d0dba4311500d928d8ee491116922504f6dd0
MD5 823906f5fc261e917af8d6b428999f34
SHA1 bb6c05d795836a24d2fe1c40b376182b7a033857
SHA512 6c7e20b84dc0e1c6857d7ac6b9421940409719ac04c479c58c547af6f65add2e95c490d5f68705369fc27287cb9f2b2b8fcde39516e8a509e17a57c527043cb3
SSDEEP 49152:CFdRlmXhlMe9F3V6q3Py4nrwgoKWAhYv1QFTSFQr:aluVpo99QFE
TLSH
T181854A43F6B2A0B8C166C135936A7232FB217C4E45367AB72BD88A343FA5F40671DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

F:\How to Restore My Files.html

hyflock

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>HYFLOCK :: SECURITY NOTICE</title> <style> @import url('https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@300;400;500;600;700&family=Share+Tech+Mono&display=swap'); * { margin: 0; padding: 0; box-sizing: border-box; } body { font-family: 'JetBrains Mono', 'Courier New', monospace; background: #0a0a0f; color: #e0e0e0; min-height: 100vh; overflow-x: hidden; } /* Scanline effect */ body::before { content: ''; position: fixed; top: 0; left: 0; right: 0; bottom: 0; background: repeating-linear-gradient( 0deg, rgba(0, 0, 0, 0.15), rgba(0, 0, 0, 0.15) 1px, transparent 1px, transparent 2px ); pointer-events: none; z-index: 1000; } /* Glitch animation */ @keyframes glitch { 0% { text-shadow: 2px 0 #ff0055, -2px 0 #00ffff; } 25% { text-shadow: -2px 0 #ff0055, 2px 0 #00ffff; } 50% { text-shadow: 2px 0 #ff0055, -2px 0 #00ffff; } 75% { text-shadow: -2px 0 #ff0055, 2px 0 #00ffff; } 100% { text-shadow: 2px 0 #ff0055, -2px 0 #00ffff; } } @keyframes flicker { 0%, 100% { opacity: 1; } 92% { opacity: 1; } 93% { opacity: 0.8; } 94% { opacity: 1; } 97% { opacity: 0.9; } } @keyframes pulse { 0%, 100% { box-shadow: 0 0 5px #00ffff, inset 0 0 5px rgba(0,255,255,0.1); } 50% { box-shadow: 0 0 20px #00ffff, inset 0 0 10px rgba(0,255,255,0.2); } } @keyframes borderGlow { 0%, 100% { border-color: #ff0055; } 50% { border-color: #00ffff; } } .container { max-width: 900px; margin: 0 auto; padding: 40px 20px; position: relative; z-index: 1; } /* HEADER */ .header { text-align: center; margin-bottom: 40px; animation: flicker 4s infinite; } .logo-container { position: relative; display: inline-block; } .logo { font-family: 'Share Tech Mono', 'JetBrains Mono', monospace; font-size: 80px; font-weight: 700; letter-spacing: 15px; background: linear-gradient(90deg, #ff0055, #ff6600, #ffcc00, #00ff66, #00ffff, #ff00ff, #ff0055); background-size: 400% 400%; -webkit-background-clip: text; -webkit-text-fill-color: transparent; background-clip: text; animation: gradientShift 8s ease infinite, glitch 0.3s infinite; text-shadow: none; filter: drop-shadow(0 0 30px rgba(255,0,85,0.5)) drop-shadow(0 0 60px rgba(0,255,255,0.3)); } @keyframes gradientShift { 0%, 100% { background-position: 0% 50%; } 50% { background-position: 100% 50%; } } .logo-sub { font-size: 12px; color: #666; letter-spacing: 8px; margin-top: 10px; text-transform: uppercase; } .status-bar { background: rgba(0, 255, 255, 0.05); border: 1px solid #00ffff; border-radius: 4px; padding: 15px 20px; margin: 30px 0; font-size: 11px; color: #00ffff; letter-spacing: 2px; animation: borderGlow 3s infinite; } .status-bar .line { display: flex; justify-content: space-between; flex-wrap: wrap; gap: 10px; } /* SECTIONS */ .section { background: rgba(10, 10, 15, 0.9); border: 1px solid #333; border-radius: 4px; margin: 25px 0; overflow: hidden; } .section-header { background: linear-gradient(90deg, rgba(255,0,85,0.2), rgba(0,255,255,0.1)); padding: 12px 20px; font-size: 13px; font-weight: 600; color: #ff0055; letter-spacing: 3px; border-bottom: 1px solid #333; display: flex; align-items: center; gap: 10px; } .section-header::before { content: '►'; color: #00ffff; animation: blink 1s infinite; } @keyframes blink { 0%, 100% { opacity: 1; } 50% { opacity: 0.3; } } .section-content { padding: 20px; } /* WARNING BOX */ .warning-box { background: rgba(255, 0, 85, 0.1); border-left: 4px solid #ff0055; padding: 15px 20px; margin: 15px 0; } .warning-box .title { color: #ff0055; font-weight: 600; margin-bottom: 8px; font-size: 12px; letter-spacing: 2px; } .warning-box ul { list-style: none; padding-left: 0; } .warning-box li { padding: 5px 0; padding-left: 20px; position: relative; color: #ccc; font-size: 12px; } .warning-box li::before { content: '⚡'; position: absolute; left: 0; color: #ff0055; } /* CREDENTIAL BOXES */ .credential-box { background: rgba(0, 0, 0, 0.5); border: 1px solid #444; border-radius: 4px; padding: 15px; margin: 15px 0; } .credential-box .label { color: #00ffff; font-size: 11px; letter-spacing: 2px; margin-bottom: 10px; display: flex; align-items: center; gap: 8px; } .credential-box .label::before { content: '◈'; color: #ff0055; } .credential-box .value { background: rgba(0, 255, 255, 0.05); border: 1px solid #00ffff; border-radius: 3px; padding: 12px 15px; font-family: 'JetBrains Mono', monospace; font-size: 12px; color: #00ffff; word-break: break-all; line-height: 1.6; } .victim-id-box { background: rgba(34, 197, 94, 0.05); border: 1px solid #22c55e; border-radius: 4px; padding: 15px; margin: 15px 0; text-align: center; } .victim-id-box .section-label { color: #22c55e; font-size: 11px; letter-spacing: 2px; margin-bottom: 10px; } .victim-id-box .victim-id { background: rgba(34, 197, 94, 0.1); border: 2px solid #22c55e; border-radius: 4px; padding: 12px 15px; font-family: 'JetBrains Mono', monospace; font-size: 14px; color: #22c55e; letter-spacing: 2px; margin-bottom: 10px; animation: pulse 2s infinite; } .copy-btn { background: transparent; border: 1px solid #22c55e; color: #22c55e; padding: 8px 16px; font-family: 'JetBrains Mono', monospace; font-size: 10px; letter-spacing: 2px; cursor: pointer; transition: all 0.3s; } .copy-btn:hover { background: #22c55e; color: #000; } /* INSTALL STEPS */ .step { margin: 20px 0; padding: 15px; background: rgba(0, 0, 0, 0.3); border: 1px solid #333; border-radius: 4px; } .step-num { display: inline-block; background: linear-gradient(135deg, #ff0055, #ff6600); color: #fff; width: 28px; height: 28px; line-height: 28px; text-align: center; border-radius: 50%; font-size: 12px; font-weight: 700; margin-right: 10px; } .step-title { color: #fff; font-size: 13px; letter-spacing: 2px; margin-bottom: 12px; display: inline-block; } .step-content { padding-left: 38px; } .step-content p { color: #aaa; font-size: 12px; line-height: 1.8; margin-bottom: 10px; } .command { background: rgba(0, 255, 255, 0.1); border: 1px solid #00ffff; border-radius: 3px; padding: 10px 15px; font-family: 'JetBrains Mono', monospace; font-size: 11px; color: #00ffff; margin: 8px 0; word-break: break-all; } .command::before { content: '$ '; color: #ff0055; } .link { color: #00ffff; text-decoration: none; border-bottom: 1px solid #00ffff; padding-bottom: 1px; } .link:hover { color: #ff6600; border-color: #ff6600; } .sub-step { margin: 10px 0; padding-left: 15px; border-left: 2px solid #333; } .sub-step-title { color: #ff6600; font-size: 11px; letter-spacing: 1px; margin-bottom: 8px; } /* INFO BOX */ .info-box { background: rgba(0, 255, 255, 0.05); border: 1px solid #00ffff; border-radius: 4px; padding: 15px; margin: 15px 0; } .info-box .icon { color: #00ffff; margin-right: 8px; } .info-box p { color: #ccc; font-size: 12px; line-height: 1.7; } /* FOOTER */ .footer { text-align: center; margin-top: 40px; padding-top: 20px; border-top: 1px solid #333; color: #666; font-size: 10px; letter-spacing: 3px; } /* RESPONSIVE */ @media (max-width: 600px) { .logo { font-size: 40px; letter-spacing: 5px; } .status-bar { font-size: 9px; } .section-content { padding: 15px; } .step-content { padding-left: 0; } } </style> </head> <body> <div class="container">  <div class="header"> <div class="logo-container"> <div class="logo">HYFLOCK</div> </div> <div class="logo-sub">Security Division :: Enterprise Encryption System</div> </div>  <div class="status-bar"> <div class="line"> <span>► SYSTEM ENCRYPTION PROTOCOL :: v2.7.1</span> <span>► STATUS :: ALL FILES SECURED</span> <span>► NODE :: 1433333</span> </div> </div>  <div class="section"> <div class="section-header">⚠ CRITICAL SECURITY NOTICE</div> <div class="section-content"> <div class="warning-box"> <div class="title">IMMEDIATE ACTION REQUIRED</div> <ul> <li>DO NOT attempt to decrypt files yourself</li> <li>DO NOT modify or delete encrypted files</li> <li>DO NOT use third-party decryption tools</li> <li>DO NOT reboot or shut down your system</li> <li>Contact us within 48 hours to avoid data loss</li> </ul> </div> <p style="color: #888; font-size: 11px; margin-top: 15px;"> Your files have been secured with military-grade HC-128 encryption. They are NOT deleted, only inaccessible without the unique decryption key. </p> </div> </div>  <div class="section"> <div class="section-header">◈ DECRYPTION CREDENTIALS</div> <div class="section-content"> <div class="victim-id-box"> <div class="section-label">◈ YOUR VICTIM IDENTIFIER</div> <div class="victim-id">1433333</div> <button class="copy-btn" onclick="copyToClipboard('1433333')">[ COPY TO CLIPBOARD ]</button> </div> <div class="credential-box"> <div class="label">TOX CONTACT (PRIMARY)</div> <div class="value">37BC1EC8D8EEE7ECEA44A953855DAC628DF0920CE41EE4164006BDC95ADEBA5738C870A23686</div> </div> <div class="info-box"> <p><span class="icon">⏱</span> Response time: 2-24 hours. Save your Victim ID - it is required for decryption.</p> </div> </div> </div>  <div class="section"> <div class="section-header">📖 INSTALLATION GUIDE</div> <div class="section-content">  <div class="step"> <div class="step-title"><span class="step-num">1</span>INSTALL TOR BROWSER</div> <div class="step-content"> <p>Tor Browser is required for secure communication with our team.</p> <p><strong>Windows / macOS / Linux:</strong></p> <div class="command">Download: https://www.torproject.org/download/</div> <div class="sub-step"> <div class="sub-step-title">INSTALLATION STEPS:</div> <p>1. Click the download link above</p> <p>2. Download the appropriate version for your OS</p> <p>3. Run the installer and follow prompts</p> <p>4. Launch Tor Browser</p> <p>5. <strong>Keep Tor Browser running</strong> during your chat session</p> </div> </div> </div>  <div class="step"> <div class="step-title"><span class="step-num">2</span>INSTALL QTOX CLIENT</div> <div class="step-content"> <p>qTox is a secure, encrypted chat client. You need it to contact us.</p> <div class="sub-step"> <div class="sub-step-title">WINDOWS:</div> <div class="command">Option 1: https://qtox.github.io/ (download installer)</div> <div class="command">Option 2: winget install toxfoundation.qTox</div> <div class="command">Option 3: scoop install qtox</div> </div> <div class="sub-step"> <div class="sub-step-title">UBUNTU / DEBIAN:</div> <div class="command">sudo apt update</div> <div class="command">sudo apt install apt-transport-https</div> <div class="command">sudo bash -c 'echo "deb https://download.opensuse.org/repositories/home:/antonbatenev:/tox/xUbuntu_$(lsb_release -rs)/ ./" > /etc/apt/sources.list.d/tox.list'</div> <div class="command">sudo apt update && sudo apt install qtox</div> </div> <div class="sub-step"

URLs

https://qtox.github.io/
https://download.opensuse.org/repositories/home:/antonbatenev:/tox/xUbuntu_$(lsb_release
https://download.opensuse.org/repositories/home:/antonbatenev:/tox/Fedora_$(cat

Targets

- Target
  478ccc46a2b0207db57d7dae329d0dba4311500d928d8ee491116922504f6dd0.bin
- Size 1.7MB
- SHA256 478ccc46a2b0207db57d7dae329d0dba4311500d928d8ee491116922504f6dd0
- MD5 823906f5fc261e917af8d6b428999f34
- SHA1 bb6c05d795836a24d2fe1c40b376182b7a033857
- SHA512 6c7e20b84dc0e1c6857d7ac6b9421940409719ac04c479c58c547af6f65add2e95c490d5f68705369fc27287cb9f2b2b8fcde39516e8a509e17a57c527043cb3
- SSDEEP 49152:CFdRlmXhlMe9F3V6q3Py4nrwgoKWAhYv1QFTSFQr:aluVpo99QFE
- TLSH
  T181854A43F6B2A0B8C166C135936A7232FB217C4E45367AB72BD88A343FA5F40671DB54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery evasion hyflock persistence privilege_escalation ransomware spyware stealer trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Family: HYFLOCK
  HYFLOCK is a Windows ransomware first seen in early 2026.
  ransomware hyflock
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies security service
  defense_evasion
- Turns off Windows Defender SpyNet reporting
  defense_evasion
- Renames multiple (660) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies Security services
  Modifies the startup behavior of a security service.
  defense_evasion
- Drops file in System32 directory
behavioral1