HexaLocker isn’t built to make noise it’s built to cause disruption while remaining stealthy for as long as possible. It uses a multi-stage infection routine, typically starting with an initial payload dropped via phishing email. The file, often a macro-enabled document or ZIP archive, launches a script that pulls down the main ransomware binary from a remote server. Once executed, the malware scans the machine for targeted file types, documents, media, databases and locks them using strong encryption (typically AES-256 with RSA key wrapping).

What makes HexaLocker particularly devastating is that, during the same process, it silently copies sensitive files and sends them to a command-and-control server before encryption begins. This “double extortion” approach is designed to exert pressure, especially on enterprises that handle regulated or confidential data. Victims not only lose access to files but also face public data exposure unless they pay.

This malware disables recovery tools like Windows Shadow Copies and often tampers with event logs to cover its tracks. Persistence is established via registry entries or scheduled tasks, and in some versions, network propagation capabilities have been observed allowing it to spread laterally within an organization.

HexaLocker operates in a multi-stage process that begins with initial access and ends in data encryption and potential exfiltration. Here’s how it works step-by-step:

1. Initial Access and Delivery

The attack usually starts with phishing emails containing malicious attachments often disguised as invoices, job applications, or urgent alerts. These attachments are frequently macro-enabled Microsoft Office documents (like .docm or .xlsm), PDFs with embedded scripts, or archived executables. In some campaigns, attackers use email spoofing to impersonate trusted contacts or company departments, boosting credibility.

Once the user opens the file and enables macros or executes the attachment, a dropper payload is silently downloaded in the background, initiating the infection chain.

2. Execution and Persistence

Once delivered, HexaLocker executes via a loader script that deploys the core ransomware payload into memory using process injection techniques. This helps it avoid writing to disk, which makes detection by traditional antivirus software more difficult.

To maintain persistence, it may:

• Create registry run keys in HKCU\Software\Microsoft\Windows\CurrentVersion\Run
• Install a scheduled task to execute the payload upon startup
• Disguise itself as a legitimate system process (like svchost.exe or dllhost.exe)

3. File Encryption Process

After establishing its foothold, HexaLocker begins encrypting files across the victim’s system, often targeting:

• Local drives
• Network shares
• Cloud-synced folders (like OneDrive or Dropbox if synchronized locally)

It uses a hybrid encryption scheme: typically, AES-256 for bulk file encryption and RSA for encrypting the AES keys. Each file is appended with a custom extension (e.g., .hexa), and shadow copies are deleted using:

bash

CopyEdit

vssadmin delete shadows /all /quiet

This ensures victims can’t restore their data using built-in Windows tools.

4. Data Exfiltration and Extortion

Before or during encryption, HexaLocker can also scan for and upload sensitive data such as: financial records, contracts, or customer PII to a command-and-control (C2) server. This step supports double extortion, where victims are threatened with public leaks if they refuse to pay.

In more advanced variants, attackers also attempt network reconnaissance using tools like netstat, nltest, and PowerShell scripts to move laterally and encrypt additional endpoints.

5. Ransom Note and Communication

Once the encryption process is complete, a ransom note is dropped in affected directories, usually named something like READ_ME_HEXA.txt. This note typically contains:

• Payment instructions (often via Bitcoin or Monero)
• A threat to leak stolen data if the ransom is not paid within a deadline
• A unique victim ID and sometimes a TOR link for chat-based negotiation

Some versions of HexaLocker offer “free file decryption” to prove they hold the keys.

6. Evasion Techniques

HexaLocker employs several anti-analysis and anti-VM techniques:

• Detecting virtual environments (VMware, VirtualBox) and sandboxes
• Checking for the presence of analysis tools like Wireshark or Process Monitor
• Delaying execution or encrypting code segments to confuse behavior-based detection engines