WannaScream is a .NET ransomware strain for Windows, seen from early 2020. A 2020 build renames files with an ID and an email ahead of a .Harma ending, writes info.txt to each folder and puts WannaScream.hta in the Startup folder. A later build ends names with .Wanna Scream after an email and ID, and drops README.txt plus a Wanna Scream.hta pop-up. Windows endpoints are the target. The 2020 build removes shadow copies with vssadmin and gathers host details such as public IP and machine name. No file theft or leak site is tied to it.
File extensions: .H@RM@, .NORD
Decryptor: Decryptor availability has not been recorded.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161