Hunter Ransomware: A New Threat Based on Prince Ransomware

Hunter Ransomware is a newly discovered variant of the Prince Ransomware family. This malicious software encrypts victims’ files, appending the “.Hunter” extension, and demands a ransom in cryptocurrency for file recovery. It also drops a ransom note named “Decryption Instructions.txt” and modifies the desktop wallpaper to warn victims about the attack.

Hunter Ransomware Summary

Feature	Details
Threat Name	Hunter Ransomware
Threat Type	Ransomware, Crypto Virus, File Locker
Encrypted File Extension	.Hunter
Ransom Note Filename	Decryption Instructions.txt
Cybercriminal Contact	attack-tw1337@proton.me
Detection Names	Avast (Win32:Dh-A [Heur]), Combo Cleaner (Generic.Ransom.Prince.A.2D1448B6), ESET-NOD32 (A Variant Of WinGo/Filecoder.HG), Kaspersky (HEUR:Trojan-Ransom.Win64.Generic), Microsoft (Ransom:Win64/PrinceRansom.YAA!MTB)
Symptoms of Infection	Files cannot be opened, file extensions changed to .Hunter, ransom note displayed, wallpaper modification, demand for cryptocurrency payment
Damage	File encryption, potential additional malware infections, loss of sensitive data, financial loss
Distribution Methods	Malicious email attachments, torrent websites, malicious ads, pirated software, software vulnerabilities
Danger Level	High

How Hunter Ransomware Works

Once Hunter infiltrates a system, it begins encrypting files and renaming them with the ".Hunter" extension. For example:

• 1.jpg → 1.jpg.Hunter
• 2.png → 2.png.Hunter
• 3.exe → 3.exe.Hunter

After encryption, it drops a ransom note titled "Decryption Instructions.txt", demanding payment in cryptocurrency. The attackers warn victims against renaming or modifying the encrypted files, claiming this may lead to permanent data loss.

Hunter Ransom Note Text

---------- Hunter Ransomware ----------
Your files have been encrypted using Hunter Ransomware!
They can only be decrypted by paying us a ransom in cryptocurrency.
Encrypted files have the .hunter extension.
IMPORTANT: Do not modify or rename encrypted files, as they may become unrecoverable.
Contact us at the following email address to discuss payment.
attack-tw1337@proton.me
---------- Hunter Ransomware ----------

How Hunter Ransomware Infects Systems

Hunter ransomware is primarily spread through:

• Malicious Email Attachments: Phishing emails containing infected Word documents, PDFs, or ZIP files with embedded macros.
• Torrent Websites: Downloading pirated software, movies, or games from untrusted sources.
• Malicious Ads: Clicking on deceptive advertisements that redirect to exploit kits.
• Software Vulnerabilities: Outdated software with security flaws that ransomware exploits to gain access.
• Trojan Installers: Fake software updates or cracked applications that contain ransomware components.

How to Remove Hunter Ransomware from Your Computer

Step 1: Disconnect from the Internet

Immediately disconnect your device to prevent further encryption and spread to other networked devices.

Step 2: Boot into Safe Mode

1. Restart your PC and press F8 or Shift + Restart to enter Windows Recovery.
2. Select Troubleshoot > Advanced Options > Startup Settings.
3. Choose Enable Safe Mode with Networking and press Enter.

Step 3: Scan and Remove Hunter Ransomware Using SpyHunter

1. Download SpyHunter.
2. Install and launch SpyHunter.
3. Click Start Scan Now to detect ransomware and other malware.
4. After scanning, click Fix Threats to remove malicious components.

Step 4: Delete Suspicious Files and Registry Entries

1. Press Win + R, type regedit, and press Enter.
2. Navigate to:
   • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
   • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
3. Look for suspicious entries and delete them.

Step 5: Restore Your Files (If Possible)

• Use File History or Backups: If you have backups, restore your files.
• Shadow Copies (If Not Deleted by Ransomware): Use tools like ShadowExplorer to check for hidden file versions.
• Try Third-Party Decryption Tools: Check cybersecurity forums or trusted sources for decryption solutions.

How to Prevent Hunter Ransomware Infections

1. Backup Your Data Regularly: Store backups on external drives or cloud services.
2. Avoid Suspicious Emails: Do not open attachments from unknown senders.
3. Keep Software and OS Updated: Regularly install security updates to patch vulnerabilities.
4. Use Strong Antivirus and Anti-Malware Protection: Tools like SpyHunter can block ransomware before it executes.
5. Enable Windows Defender Controlled Folder Access: Protects sensitive directories from unauthorized changes.
6. Use a Firewall: Prevents unauthorized network access.

Conclusion

Hunter Ransomware is a dangerous file-encrypting malware based on Prince Ransomware. Victims should avoid paying the ransom, as it does not guarantee file recovery. The best defense against ransomware is a combination of proactive security measures and using anti-malware tools like SpyHunter for removal and system protection.