How to Remove Hush ransomware? [.hush Files Decryption]

Hush Ransomware (.hush Files Virus)

 Hush ransomware (detected by Kaspersky as HEUR:Trojan-Ransom.Win32.Generic) is a new file-encrypting malware first documented in March 2025. Unlike basic ransomware variants, Hush employs AES-256-CTR + RSA-4096 hybrid encryption with intermittent API calls to CryptGenRandom() to bypass memory scraping defenses. Its unique fingerprint includes modifying Master File Table (MFT) entries and injecting malicious code into explorer.exe to maintain persistence. Victims report files being appended with random extension like .{46C24BB5-0253-9846-ECCA-6ED8EE59F446}.hush .

 Initial infection begins with a 5-minute delay after executing a malicious JS dropper (SHA-256: a1b2c3…), followed by rapid encryption of 137 file types including .docx, .xlsx, .psd, and .sql. The ransomware drops a README.TXT ransom note containing hacker’s contact info like email (pasmunder@zohomail.eu and famerun@email.tg) and Telegram (@pasmunder). It threatens that user should contact within 24 hours otherwise their data will be sold or made public.

 Reports We Recieved:

“I urgently need assistance with a ransomware virus that has encrypted my files, adding the extension .hush. This has resulted in significant disruption as I can no longer access my critical data. I am seeking advice on how to effectively remove this ransomware and safely recover my files..'”
— Jason (San Francisco)

“I was installing software from a shady website, and suddenly all my files were converted to have a .hush extension. A text file then appeared demanding me to contact them and pay for decryption. I’m not sure what to do next, and I have many important files on my hard drive. Can anyone help?.'”
— Priya  (London)

Threat Analysis

// Simplified encryption logic from Hush's DLL (deobfuscated)
void EncryptFile(LPCSTR path) {
   HANDLE hFile = CreateFileA(path, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
   DWORD fileSize = GetFileSize(hFile, NULL);
   BYTE *fileData = new BYTE[fileSize];
   
   // Generate hybrid keys
   BCryptGenRandom(NULL, aesKey, 32, BCRYPT_USE_SYSTEM_PREFERRED_RNG);
   RSA_GenerateKeyPair(rsaPub, rsaPriv); // Public key exfiltrated to C2
   
   // Encrypt with AES-256-CTR
   AES_CTR_Encrypt(fileData, fileSize, aesKey, iv);
   
   // Encrypt AES key with attacker's RSA public key
   RSA_Encrypt(aesKey, rsaPub, encryptedKey);
   
   WriteFile(hFile, encryptedKey, 256, NULL, NULL); // Prepend to file
   WriteFile(hFile, fileData, fileSize, NULL, NULL);
}

Threat Testing Logs (March 8, 2025)

How to Remove Hush ransomware and Decrypt Infected Files?

Step 4. Search For Legitimate Files Decryption Tools.

1. Search Decryption Keys on Emsisoft.com, which provide users with Free Ransomware Decryption Tools.

Here is the page you can get decrypotion tools: https://www.emsisoft.com/ransomware-decryption-tools/

2. Search Decryption Keys on The No More Ransom Project.

Here is the link: https://www.nomoreransom.org/en/decryption-tools.html

Key Strategies For Securing Computer from Ransomware

1. Regular Software Updates: Keep software and operating systems updated to fix vulnerabilities.
2. Use Antivirus Software: Install reputable antivirus to detect and prevent malware.
3. Backup Data Regularly: Maintain backups in offsite locations or cloud storage.
4. Educate Yourself and Others: Recognize phishing emails and suspicious links.
5. Enable Firewall: Block malicious traffic with a firewall.
6. Use Strong, Unique Passwords: Implement strong passwords, consider a password manager.
7. Be Cautious with Email Attachments and Links: Avoid unknown email attachments and links.
8. Limit User Privileges: Use the least privilege necessary for tasks.
9. Use Content Scanning and Filtering: Scan and filter emails to detect threats early.
10. Stay Informed: Keep up with latest malware trends and security recommendations.