RansomHub Ransomware Removal Guide

Signs of Infection

RansomHub infection is typically accompanied by overt signs of encryption and specific technical artifacts. The primary indicator is the appearance of ransom notes, commonly named README.txt, RESTORE_FILES.txt, or RansomHub-README.txt, dropped in every encrypted directory. These notes contain instructions for contacting the attackers via a Tor payment portal.

On the file system, look for a distinct file extension appended to encrypted files. RansomHub has used extensions like .ransomhub, .rhub, or a unique multi-character string generated per victim (e.g., .id-[RANDOM]-[ATTACKER_EMAIL]). Check user directories (Desktop, Documents, Pictures) and network shares for files with this new extension. Temporary directories (%TEMP%, C:\Windows\Temp) may contain the ransomware executable or related payloads with random alphanumeric names (e.g., f73jhg.exe, svc_update.dll).

Process behavior is critical. Examine running processes for suspicious, high-consumption rundll32.exe or msiexec.exe instances loading unusual DLLs, or unknown processes with names mimicking system utilities (e.g., windows_update.exe, securityscan.exe). RansomHub often attempts to delete Volume Shadow Copies to prevent recovery using the command vssadmin delete shadows /all /quiet or wbadmin delete catalog -quiet.

Network signs include outbound connections to suspicious IP addresses or domains associated with command and control (C2) servers. Traffic may be directed to newly registered domains with names related to software, updates, or cloud services. Look for HTTPS or SSL traffic on non-standard ports. Failed attempts to reach known threat intelligence-blocked IPs from an internal host can also be an indicator.

Immediate Containment Steps

Within the first 15 minutes of detection, your priority is to prevent the ransomware from spreading and causing further damage.

Isolate the Affected System(s): Immediately disconnect the infected machine from the network. Disable wired and wireless network adapters. If the infection is detected on multiple systems, segment the affected network segment from the rest of your infrastructure using network access control or firewall rules.
Identify the Scope: Determine if this is an isolated incident or a broader attack. Check key servers (file servers, domain controllers, backup servers) for signs of encryption or suspicious processes. Review security appliance logs for related alerts.
Terminate Malicious Processes: On the isolated host, use a command-line process viewer to identify the ransomware process. Look for the unfamiliar processes noted earlier. Terminate them using the command line with the /PID flag. Avoid using the graphical task manager, as ransomware may interfere with it.
Secure Backups: Ensure your backup systems are physically or logically disconnected from the infected environment to prevent them from being encrypted. Verify the integrity of the most recent backups.
Initiate Credential Rotation: As a precaution, plan for the rotation of privileged credentials, especially if there is evidence of lateral movement. Start with credentials for the initially infected host and domain administrator accounts. Use a clean, trusted system to perform the password changes.

Manual Removal Process

Warning: Manual removal will NOT decrypt your files. It only removes the malware binary and its persistence mechanisms. Follow these steps on the isolated system.

Terminate RansomHub Processes:
- Open a command prompt as Administrator.
- Run tasklist /v to list all processes. Identify suspicious processes with high CPU or memory usage and random names.
- Terminate each malicious process using taskkill /f /pid [PID].
Delete Malicious Files:
- Navigate to common temporary directories and delete any recently created suspicious executables or DLLs.
  - %TEMP%
  - C:\Windows\Temp
  - %APPDATA%
  - %LOCALAPPDATA%
- Search for files with the RansomHub extension (e.g., *.ransomhub) to locate the ransomware binary itself, which may be in the same directory as the encrypted files. Delete it.
- Delete all ransom note files (README.txt, RESTORE_FILES.txt).
Remove Persistence Mechanisms:
- Open the Registry Editor (regedit).
- Navigate to and carefully check the following keys for suspicious entries pointing to the file paths of the removed executables:
  - HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  - HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  - HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
- Delete any malicious entries. Common RansomHub registry values may have names like “UpdateCheck” or “SecurityClient”.
Clear Scheduled Tasks:
- Open Command Prompt as Admin and run schtasks /query /fo LIST /v.
- Review tasks for those with suspicious authors, actions (running a strange .exe or .dll), or triggers.
- Delete malicious tasks with schtasks /delete /tn "TaskName" /f.
Disable Unnecessary Services: Run services.msc and look for newly created services with random or deceptive names. Set them to Disabled and stop the service if it is running.

Verifying Removal

After completing the manual removal, confirm the system is clean.

File System Scan: Perform a full system scan with your updated endpoint detection and response (EDR) solution. Use a dedicated anti-malware scanner from a trusted vendor as a second opinion. Ensure no files with the RansomHub extension are executable or present in system directories.
Process and Network Monitoring: Use a lightweight monitoring tool to observe system processes and network connections for several hours. No new suspicious processes should spawn, and there should be no outbound calls to the C2 indicators of compromise (IOCs).
Log Analysis: Review Windows Event Logs (especially Security, System, and Application logs) for the hours surrounding the infection. Look for:
- Event ID 4688 (process creation) for the malicious executable.
- Event ID 4104 (script execution) if PowerShell was used.
- Any errors related to failed service starts from the deleted registry entries.
Persistence Check: Re-examine the Run registry keys, scheduled tasks, and service listings to ensure the malicious entries have not reappeared.
Network Traffic Analysis: Use your SIEM platform or network monitoring tool to verify that the infected host, once reconnected to a monitored test network, is no longer communicating with known-bad IPs or domains associated with RansomHub.

Post-Removal Security Hardening

To prevent reinfection via similar vectors, implement these measures.

Application Control: Implement application allowlisting policies to prevent the execution of unauthorized software, especially from user directories like %TEMP% and %APPDATA%. This is one of the most effective controls against ransomware.
Privilege Access Management: Enforce the principle of least privilege. Remove local administrator rights from standard users. Use dedicated admin accounts for system management, not daily use.
Enhanced Monitoring Rules: Configure your EDR and SIEM to alert on key RansomHub behaviors:
- Processes executing vssadmin delete shadows or wbadmin delete catalog.
- Rapid, mass file renames or encryption events (changes to file headers).
- Creation of ransom note files (README.txt) in multiple directories.
- Outbound network connections to IPs/countries not relevant to your business.
Network Segmentation: Segment critical networks, particularly separating file servers from general user workstations. Restrict SMB/RDP traffic to only necessary paths.
Backup Integrity & Air-Gapping: Ensure backups follow the 3-2-1 rule and are stored immutable or offline. Regularly test backup restoration procedures.
Patch Management: Prioritize patching for public-facing applications and systems used for initial access, such as VPNs, RDP, and email gateways. RansomHub affiliates often exploit known vulnerabilities.

For the most current technical indicators, refer to the Current RansomHub IOCs. To understand detection efficacy, review the Detection Rate. For more context on this threat, see the RansomHub Overview.

RansomHub - Removal Guide