Ransomware Research
H34rtBl33d Ransomware
H34rtBl33d is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on March 1, 2018, this ransomware has been actively targeting systems worldwide. Security researchers also track this malware under the aliases: HeartBleed, D3G1D5Crypt.
Quick Facts
- Ransomware Family
- H34rtBl33d
- First Seen
- March 1, 2018
- Known Aliases
- HeartBleedD3G1D5Crypt
How H34rtBl33d Ransomware Works
File Encryption Patterns
H34rtBl33d modifies encrypted files using specific patterns to mark them as encrypted:
File extensions added after encryption:
..H34rtBl33dRansom Note and Payment Demands
After encrypting files, H34rtBl33d displays ransom notes demanding payment for file recovery:
H34rtBl33d.txtRansom message:
notes/H34rtBl33d.txt
Note locations:
DesktopH34rtBl33d.htmlRansom message:
notes/H34rtBl33d.html
Note locations:
DesktopRansom message:
notes/note.txt
Note locations:
OnceOnCompletionRansom message:
notes/H34rtBl33d.bmp
Note locations:
DesktopTechnical Indicators
Associated Executable Files
The following executable files are associated with H34rtBl33d ransomware:
DnThirTeen.exeH34rtBl33d.exe
Elastio Can Help You
Don't let H34rtBl33d ransomware take over your data
Elastio provides advanced ransomware protection and recovery solutions to keep your organization safe.
About This Analysis
This H34rtBl33d ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery solutions, helping organizations defend against and recover from ransomware attacks like H34rtBl33d.
Last updated: July 30, 2025