--- title: "Hydrox: A new wiper attacks" description: Hydrox was first spotted by Twitter user Petrovich on July 29, 2022. On August 3, EnigmaSoft described this threat as a harmful malware that actually wipes users' data. This conclusion was made from a “ransom note” which didn’t actually contain any credentials or links for paying the ransom. canonical_url: https://www.acronis.com/en/tru/posts/hydrox-a-new-wiper-attacks/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 16 August 2022 # Hydrox: A new wiper attacks Hydrox was first spotted by Twitter user Petrovich on July 29, 2022. On August 3, EnigmaSoft described this threat as a harmful malware that actually wipes users' data. This conclusion was made from a “ransom note” which didn’t actually contain any credentials or links for paying the ransom. Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)** ## Summary * Discovered in 2022 * First file is a dropper, which drops two .exe and one .mp4 files * The dropped ‘HBvhjGVC.exe’ file spawns a window with information about encrypted files and creates a new process with timer, which will shut down the machine * The second dropped file, ‘setup.exe’ encrypts files with AES and RSA algorithms, deletes all backup catalogs and shadow copies, terminates particular services, changes the desktop background and overwrites the beginning of the bootable drive * All encrypted files have .hydrox extension * Ransom note didn’t contain any credentials or links for paying ransom, which makes it a data wiper * Hydrox (1).exe is written in C++, HBvhjGVC.exe in PureBasic * setup.exe is a .NET application ## Introduction Hydrox was first spotted by Twitter user [Petrovich](https://twitter.com/petrovic082/status/1553060846456152064) on July 29, 2022. On August 3, [EnigmaSoft](https://www.enigmasoftware.com/hydroxransomware-removal/) described this threat as a harmful malware that actually wipes users' data. This conclusion was made from a “ransom note” which didn’t actually contain any credentials or links for paying the ransom. Instead, it has the text phrase: “You don’t need to pay to decrypt your files, hydrox doesn’t have a password or a tool for decryption, so don’t try to search the password or crack it”. ## Technical Details ### Overview The inspected Hydrox sample (sha256: a467f399bf3877fe68712f278c2e21a58e63befcb23624b522d7c194fa1f1213) is written in C++, and Detect It Easy defines it as a RAR archive. ![Image 1: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/689d8975c94e021d16659bc2b21fd090.png) In the file manifest, there is information indicating that this file is a WinRar SFX (Self-Extracting Archive) module. ![Image 2: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/77bc1e6bdb0ae0320dc621ecb9ed7232.png) The file contains several resources, including pictures, icons, dialogs and strings tables. It also has an interesting icon: ![Image 3: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/7eb17be635e0d7a60bc1833cb811ca1a.png) ![Image 4: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/36c5fb0432062aae9a477d2053f74d29.png) ### Execution This RAR self-extractor file acts as a dropper, and it drops several executable files — ‘HBvhjGVC.exe’ and ‘setup.exe’ — in the _“C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'' folder_. It also drops the ‘nyandub.mp4’ file and starts playing it: ![Image 5: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/789d7341c63faa631367eac8b5ba190a.png) The first dropped file is a PE32 file written in PureBasic. This file contains some resources, one of which includes some code that will be dropped as a '.bat' file and executed. It will open a window with the message about file encryption and start a new process — ‘timout.exe’ — which shuts down the machine after a specified period. ![Image 6: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/1277c4ed21dee1f893b08d52313d7371.png) ![Image 7: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/dcfb9a1ed80f9660868c1f759a61ddf2.png) ![Image 8: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/f2b69ce5ce91b0283c62ca361961cd0e.png) The second file, ‘setup.exe,’ is a file encryptor and a .NET file. ![Image 9: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/0c933a3791c84f516c49cd984b3e9103.png) Execution starts from the ‘Main()’ function. This will check whether the application is already running, register itself in the registry if it has administrative privileges, and will delete shadow copies, disable recovery mode, delete backup catalogs, disable Task Manager and backup services. ![Image 10: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/f79a802085e3d6f8805d936194ac5793.png) ![Image 11: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/7d78a622059b390b214ca4c1fe502c21.png) Hydrox uses these commands in the Main() function routine: _wbadmin delete catalog -quiet_ _vssadmin delete shadows /all /quiet & wmic shadowcopy delete_ _bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no_ To disable Task Manager, it writes the registry key: _Software\Microsoft\Windows\CurrentVersion\Policies\System_ with ‘_DisableTaskMgr", "1"_’ value Services that will be stopped: "BackupExecAgentBrowser", "BackupExecDiveciMediaService", "BackupExecJobEngine", "BackupExecManagementService", "vss", "sql", "svc$", "memtas", "sophos", "veeam", "backup", "GxVss", "GxBlr", "GxFWD", "GxCVD", "GxCIMgr", "DefWatch", "ccEvtMgr", "SavRoam", "RTVscan", "QBFCService", "Intuit.QuickBooks.FCS", "YooBackup", "YooIT", "zhudongfangyu", "sophos", "stc_raw_agent", "VSNAPVSS", "QBCFMonitorService", "VeeamTransportSvc", "VeeamDeploymentService", "VeeamNFSSvc", "veeam", "PDVFSService", "BackupExecVSSProvider", "BackupExecAgentAccelerator", "BackupExecRPCService", "AcrSch2Svc", "AcronisAgent", "CASAD2DWebSvc", "CAARCUpdateSvc", "TeamViewer" ### File encryption The encryption process starts from the ‘lookForDirectories()’ function, which searches folders to encrypt. If a found folder matches the saved list, Hydrox will skip it; if not, it will call the ‘encryptDirectory()’ function. ![Image 12: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/8c82d1f67756c13c0326f4e7f740c712.png) The ‘encryptDirectory()’ function reads filenames and extensions, and compares them with its own list. If the file matches, it will be encrypted. ![Image 13: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/8a0c0ea164329fab4e279fc14d345d8d.png) The saved list of extensions: _".txt", ".jar", ".dat", ".contact", ".settings", ".doc", ".docx", ".xls", ".xlsx", ".ppt", ".pptx", ".odt", ".jpg", ".mka", ".mhtml", ".oqy", ".png", ".csv", ".py", ".sql", ".mdb", ".php", ".asp", ".aspx", ".html", ".htm", ".xml", ".psd", ".pdf", ".xla", ".cub", ".dae", ".indd", ".cs", ".mp3", ".mp4", ".dwg", ".zip", ".rar", ".mov", ".rtf", ".bmp", ".mkv", ".avi", ".apk", ".lnk", ".dib", ".dic", ".dif", ".divx", ".iso", ".7zip", ".ace", ".arj", ".bz2", ".cab", ".gzip", ".lzh", ".tar", ".jpeg", ".xz", ".mpeg", ".torrent", ".mpg", ".core", ".pdb", ".ico", ".pas", ".db", ".wmv", ".swf", ".cer", ".bak", ".backup", ".accdb", ".bay", ".p7c", ".exif", ".vss", ".raw", ".m4a", ".wma", ".flv", ".sie", ".sum", ".ibank", ".wallet", ".css", ".js", ".rb", ".crt", ".xlsm", ".xlsb", ".7z", ".cpp", ".java", ".jpe", ".ini", ".blob", ".wps", ".docm", ".wav", ".3gp", ".webm", ".m4v", ".amv", ".m4p", ".svg", ".ods", ".bk", ".vdi", ".vmdk", ".onepkg", ".accde", ".jsp", ".json", ".gif", ".log", ".gz", ".config", ".vb", ".m1v", ".sln", ".pst", ".obj", ".xlam", ".djvu", ".inc", ".cvs", ".dbf", ".tbi", ".wpd", ".dot", ".dotx", ".xltx", ".pptm", ".potx", ".potm", ".pot", ".xlw", ".xps", ".xsd", ".xsf", ".xsl", ".kmz", ".accdr", ".stm", ".accdt", ".ppam", ".pps", ".ppsm", ".1cd", ".3ds", ".3fr", ".3g2", ".accda", ".accdc", ".accdw", ".adp", ".ai", ".ai3", ".ai4", ".ai5", ".ai6", ".ai7", ".ai8", ".arw", ".ascx", ".asm", ".asmx", ".avs", ".bin", ".cfm", ".dbx", ".dcm", ".dcr", ".pict", ".rgbe", ".dwt", ".f4v", ".exr", ".kwm", ".max", ".mda", ".mde", ".mdf", ".mdw", ".mht", ".mpv", ".msg", ".myi", ".nef", ".odc", ".geo", ".swift", ".odm", ".odp", ".oft", ".orf", ".pfx", ".p12", ".pl", ".pls", ".safe", ".tab", ".vbs", ".xlk", ".xlm", ".xlt", ".xltm", ".svgz", ".slk", ".tar.gz", ".dmg", ".ps", ".psb", ".tif", ".rss", ".key", ".vob", ".epsp", ".dc3", ".iff", ".onepkg", ".onetoc2", ".opt", ".p7b", ".pam", ".r3d", ".bat", ".cmd", ".jfif", ".exe"_ Hydrox encrypts files with the AES algorithm, with different implementations for small and large files. The AES key is encrypted with the RSA key. All files will have the '.hydrox' extension. The hardcoded public RSA key is shown below: ![Image 14: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/f46ed6ac6d68aef1bbee0cd668f18351.png) ![Image 15: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/86b7c189d2d24d150af90c763098866c.png) If the current folder contains child folders, they will be encrypted with the same function. ![Image 16: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/1fb494cf910102156f532d865ec8c1b7.png) It will drop the ransom note ‘Hydrox Ransomware.txt,’ stored in the code: ![Image 17: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/f44970d41bb27ec4dfe18b79e763523e.png) Finally, it will change the desktop background. The picture is saved in the code in Base64 format: ![Image 18: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/de31bd8420556ab6b616b4258e216aa1.png) ![Image 19: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/0d1e5a7a3cdc26b494cd4208a64c8995.png) ![Image 20: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/be0cdd53888ead220782033a8a55763f.png) Hydrox will obtain all drives in the system to write the ‘nyancat.exe’ file. This file is a copy of the ‘setup.exe’ file. ![Image 21: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/c8af02ac09c5660f4a7acf351b7734ad.png) Hydrox also overwrites the MBR by writing code to the beginning of the “\Device\Harddisk0\DR0” bootable disk which shows the same image as the wallpaper. ![Image 22: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/62881592cc32b3351c895a132566505d.png) ### Obfuscation ‘Hydrox (1).exe’ has function call obfuscation, loading them into one of the general-purpose registers before calling them. ![Image 23: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/a666df76f262ea46ea247249c135d175.png) ### Ransom note Based on this ransom note, Hydrox malware doesn’t offer victims the chance to recover their files for a ransom. The main purpose is to harm the victim and disrupt systems. ![Image 24: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/531ecd8839da9c2a889594f982963906.png) ## Conclusion Hydrox malware, though presenting as ransomware, actually encrypts files and doesn't give victims the opportunity to decrypt them for a ransom. It takes the form of a file dropper, which delivers the other two executable files. One of these creates a process that shuts down the system, and the other one encrypts files with AES and RSA algorithms. Hydrox deletes backup folders and shadow copies, terminates system services, changes the desktop background and overwrites the MBR. As a result, impacted system won’t boot. ## Detected by Acronis ![Image 25: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/d9c8c11741cae612763ed383534a5237.png) ![Image 26: Hydrox: A new wiper attacks](https://staticfiles.acronis.com/images/content/ae5793f304a70148c4305ad025f17313.png) ## IoCs ### Files File name SHA256 Hydrox (1).exe a467f399bf3877fe68712f278c2e21a58e63befcb23624b522d7c194fa1f1213 setup.exe 24d49f947f968c4f654ebfa2d4c0bdd3a8ddf45cfa909dc8b36b557724b14361 HBvhjGVC.exe 9d69497e10161895c99000e3f5611acc87b5f0e9752023f8ae1a5f1f0fff29cb Related articles [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) [Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/) [Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/) [AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)