{
  "family": "hebogo",
  "sample_count": 31,
  "category": "ransomware",
  "description": "Hebogo (classified across antimalware engines and threat intelligence feeds under signatures including Ransom:Win32/Hebogo, Trojan-Ransom.Win32.Hebogo, and Trojan.Hebogo) is a crypto-ransomware and extortion threat active since 2016. Delivered through phishing emails containing weaponized office attachments, malicious torrents, and compromised software installers, Hebogo executes rapid local discovery before deploying destructive encryption routines. Hebogo scans fixed, removable, and mapped network drives, searching for user documents, spreadsheets, databases, and media files, encrypting them using strong AES-256 encryption. It deletes Volume Shadow Copies (vssadmin delete shadows /all /quiet) to prevent system restoration, alters desktop wallpaper to an extortion notice, and drops ransom instructions demanding Bitcoin payment in exchange for a private decryption key.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Hebogo",
    "Trojan-Ransom.Win32.Hebogo",
    "Trojan.Hebogo",
    "Win32/Hebogo",
    "Ransom:Win32/Hebogo.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Hebogo?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Hebogo is a crypto-ransomware family that encrypts personal files with AES-256 and demands Bitcoin ransom payments for decryption."
      }
    },
    {
      "@type": "Question",
      "name": "How does Hebogo encrypt files?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It traverses local and network drives, using the AES-256 encryption algorithm to lock documents, images, databases, and archives."
      }
    },
    {
      "@type": "Question",
      "name": "How does Hebogo prevent system restoration?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It runs the vssadmin utility to purge Volume Shadow Copies, preventing users from reverting files to previous restore points."
      }
    },
    {
      "@type": "Question",
      "name": "How does Hebogo infect Windows systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is commonly delivered through phishing email attachments, cracked software downloads, and malicious torrent files."
      }
    },
    {
      "@type": "Question",
      "name": "How should organizations defend against Hebogo ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy automated immutable backups, enable Controlled Folder Access in Windows Defender, and restrict execution of unauthorized binaries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1547.001",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Malicious Documents",
    "P2P Software Torrents & Keygens",
    "Drive-by Download Exploits"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "AES-256 Symmetric File Encryption",
    "Volume Shadow Copy Deletion (vssadmin)",
    "Desktop Wallpaper Ransom Alert Modification",
    "Network Share File Enumeration & Locking",
    "Registry Autostart Extortion Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Ransom Note Text File (.txt)"
    ],
    "network_signatures": [
      "HTTP/HTTPS POST requests transmitting victim system UID and generated encryption session keys to remote C2 servers",
      "Tor-routed payment portal communications for ransom negotiation"
    ],
    "evasion_techniques": [
      "Terminating database and backup processes to release file locks prior to encryption",
      "Dynamic API resolution to hide cryptography API imports from static file scanners"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "59d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8",
      "6ae1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\HebogoLocker",
      "HKCU\\Control Panel\\Desktop\\Wallpaper"
    ],
    "file_paths": [
      "%Temp%\\hebogo.exe",
      "%Desktop%\\DECRYPT_YOUR_FILES.txt",
      "%AppData%\\Hebogo\\session.dat"
    ]
  },
  "defensive_measures": [
    "Enforce automated, air-gapped backups to guarantee recovery without paying ransom demands",
    "Enable Controlled Folder Access in Microsoft Defender to protect sensitive file directories",
    "Block execution of vssadmin from unprivileged user accounts to preserve system recovery snapshots"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Hebogo",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Hebogo"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom.Win32.Hebogo",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Ransom:Win32/Hebogo.A",
      "Ransom:Win32/Hebogo.B"
    ]
  },
  "motivation": "Financial Cybercrime & Extortion Ransom Payments",
  "sample_hashes": []
}