DJVU General information
DJVU cryptoware codifies the users’ data with the AES-556 algorithm (CFB mode). However, it does not encrypt the entire file, but rather approximately 5 MB in its beginning. Subsequently, it asks for the ransom that amounts to $980 in Bitcoin equivalent to restore the files.
The authors of the malware have Russian roots. The frauds use Russian language and Russian words written in English, as well as the domains registered through Russian domain-registration companies. The crooks most likely have allies in other countries.
DJVU Technical details
Many users indicate that the cryptoware is injected after downloading repackaged and infected installers of popular programs, pirated activators of MS Windows and MS Office (such as KMSAuto Net, KMSPico, etc.) distributed by the frauds through popular websites. This relates to both legitimate free applications and illegal pirated software.
The cryptoware may also be spread through hacking by means of poorly protected RDP configuration, via email spam and malicious attachments, misleading downloads, exploits, web injectors, faulty updates, repackaged and infected installers.
The list of file extensions subject for encryption:
MS Office or OpenOffice documents, PDF and text files, databases, photos, music, video or image files, archives, application files, etc.
Stages of cryptoware infection:
- Once launched, the cryptoware executable connects to the Command and Control server (С&C). Consequently, it obtains the encryption key and the infection identifier for the victim’s PC. The data is transferred under the HTTP protocol in the form of JSON.
- If С&C is unavailable (in times when the PC is not connected to the Internet of the server does not respond), the cryptoware applies the directly specified encryption key concealed in its code and performs the autonomous encryption. In this case, it is possible to decrypt the files without paying the ransom.
- The cryptoware uses rdpclip.exe to replace the legitimate Windows file and for implementing the attack on the computer network.
- Upon successful file encryption, the cipherer is autonomously removed by means of the delself.bat command file.
%LocalAppData%\[guid]\[random_numbers]tmp.exe %LocalAppData%\[guid]\1.exe %LocalAppData%\[guid]\2.exe %LocalAppData%\[guid]\3.exe %LocalAppData%\[guid]\updatewin.exe C:\Windows\System32\Tasks\Time Trigger Task
Associated Registry Entries:
In addition to encrypting a victim’s files, the DJVU family has also install the Azorult Spyware to steal account credentials, cryptocurrency wallets, desktop files, and more.
How to decrypt DJVU files?
Michael Gillespie, the expert on cryptoware research, managed to invent the decoder for certain versions when the encryptor applies the offline encryption key.
Michael released a free decryption tool – STOPDecrypter. The tool includes a BruteForcer only for variants which use XOR encryption, a simple symmetric cipher that is relatively easy to break. The decrypter tool requires victims to provide an encrypted and original file pair greater than 150KB.
Remember: STOPDecrypter should be run as an Administrator from the Desktop.
The full list of known DJVU files extension:
djvuu, uudjvu, blower, tfudet, promok, djvut, djvur, klope, charcl, doples, luces, luceq, chech, proden, drume, tronas, trosak, grovas, grovat, roland, refols, raldug, etols, guvara, browec, norvas, moresa, verasto, hrosas, kiratos, todarius, hofos, roldat, dutan, sarut, fedasot, forasom, berost, fordan, codnat, codnat1, bufas, dotmap, radman, ferosas, rectot, skymap, mogera, rezuc, stone, redmat, lanset, davda, poret, pidon, heroset, myskle, boston, muslat, gerosan, vesad, horon, neras, truke, dalle, lotep, nusar, litar, besub, cezor, lokas, godes, budak, vusad, herad, berosuce, gehad, gusau, madek, tocue, darus, lapoi, todar, dodoc, novasof, bopador, ntuseg, ndarod, access, format, nelasod, mogranos, nvetud, cosakos, kovasoh, lotej, prandel, zatrov, masok, brusaf, londec, kropun, londec
The list of STOP (DJVU) Ransomware.
- Pedro virus. How to decrypt .pedro files?
- Nacro virus. How to decrypt .nacro files?
- Nasoh Virus File (Ransomware) – Remove + Restore Files
- How to remove Coharos virus and restore .coharos files?
- How to remove Mtogas virus and restore .mtogas files?
- Krusop Virus File (Ransomware) – Remove + Restore Files
- How to remove Londec virus and restore .londec files?
- Brusaf Virus Removal + Decrypt .brusaf Files For Free
- Masok Virus Removal + Decrypt .masok Files For Free
- Zatrov Virus Removal + Decrypt .zatrov Files For Free
- Prandel Virus Removal + Decrypt .prandel Files For Free
- Lotej Virus File (DJVU Ransomware) – Remove + Restore Files
- Kovasoh Virus File (DJVU Ransomware) – Remove + Restore Files
- Cosakos Virus File (DJVU Ransomware) – Remove + Restore Files
- Nvetud Virus File (DJVU Ransomware) – Remove + Restore Files
- Mogranos Virus File (DJVU Ransomware) – Remove + Restore Files
- Nelasod Virus File (DJVU Ransomware) – Remove + Restore Files
- Format Virus File (DJVU Ransomware) – Remove + Restore Files
- Access virus. How to decrypt .access files?
- Ndarod virus. How to decrypt .ndarod files?
- Ntuseg virus. How to decrypt .ntuseg files?
- Bopador virus. How to decrypt .bopador files?
- Novasof virus. How to decrypt .novasof files?
- Dodoc virus. How to decrypt .dodoc files?
- Todar virus. How to decrypt .todar files?
- Lapoi virus. How to decrypt .lapoi files?
- Madek virus. How to decrypt .madek files? (July 2019 Update)
- Darus virus. How to decrypt .darus files?
- Tocue virus. How to decrypt .tocue files?
- Gusau virus. How to decrypt .gusau files?
- Gehad virus. How to decrypt .gehad files?
- Vusad virus. How to decrypt .vusad files?
- Berosuce virus. How to decrypt .berosuce files?
- Herad virus. How to decrypt .herad files?
- Godes virus. How to decrypt .godes files? (July 2019 Update)
- Lokas Virus Removal & Files Recovery (July 2019 Update)
- Cezor Virus Removal & Recovery Files (July 2019 Update)
- Truke Virus File – Removal + Restore Data (July 2019 Update)
- Budak virus. How to decrypt .budak files?
- Norvas virus. How to decrypt .norvas files?
- Vesad virus. How to decrypt .vesad files?
- MUSLAT virus. How to decrypt .muslat files?
- FEROSAS virus. How to decrypt .ferosas files?
- NERAS Virus. How to decrypt .neras files?
- Cizer Ransomware. How to decrypt .cizer files
- Litar Ransomware. How to decrypt .litar files
- Nusar virus attack. How to decrypt nusar files
- Kropun Virus (Ransomware) – Remove + Restore Files
User Review( vote)