AHGR Virus (.AHGR Files Ransomware) Decrypt + Removal Tool

The Ahgr virus belongs to the STOP/DJVU family of ransomware-type infections. It encrypts your files (videos, photos, documents), which can be identified by the “.ahgr” extension. This virus employs a strong encryption method that renders key calculation impossible.

I have compiled a comprehensive list of all possible solutions, tips, and techniques for neutralizing the Ahgr ransomware and decrypting your data. In certain scenarios, retrieving your files is straightforward, while in other cases, it may be impossible.

When the Ahgr ransomware infects your computer system, it initiates the encoding of files and appends an “.ahgr” extension to the encrypted files. The virus requires a ransom in order to obtain a decryption key that can unlock the encrypted files. Typically, the ransom note appears as a text file named “_readme.txt”.

Each victim is assigned a unique Ahgr key, except in one scenario:

• If malware fails to establish a connection with its command and control servers (C&C Server) prior to commencing the encryption process, it uses offline keys. These keys are the same for all victims, enabling the decryption of files that were encrypted during a ransomware attack.

What is Ahgr?

☝️ Ahgr can be correctly identify as a STOP/DJVU ransomware infection.

The Ahgr ransomware is a specific kind of malware that encrypted your documents and then forces you to pay to restore them. Djvu/STOP ransomware family was first revealed and discovered by virus analyst Michael Gillespie.

Ahgr ransomware is basically similar to other representatives of the same DJVU family: Ahtw, Ahui, Neqp. This virus encrypt all common file types and adds its own “.ahgr” extension into all files. For example, the file “1.jpg”, will be amended into “1.jpg.ahgr“. As soon as the encryption is accomplished, virus generates a specific text file “_readme.txt” and adds it into all folders that contain the modified files.

Below is an illustrative image showcasing the appearance of files with the “.ahgr” extension:

Ahgr File (STOP/DJVU Ransomware)

This text asking payment is for get files back via decryption key:

_readme.txt (STOP/DJVU Ransomware) – The scary alert demanding from users to pay the ransom to decrypt the encoded files contains these frustrating warnings

The Ahgr ransomware performs a range of operations on the victim’s computer to accomplish various tasks. One of the first operations executed is winupdate.exe, which displays a deceptive Windows update prompt throughout the attack. This strategy is designed to deceive the victim into associating sudden system slowdowns with a Windows update. At the same time, the ransomware triggers another operation (usually named with four random characters) to scan the system for specific files and encrypt them. Furthermore, the ransomware utilizes the following CMD command to delete Volume Shadow Copies:

vssadmin.exe Delete Shadows /All /Quiet

Once deleted, it becomes impossible to restore the previous state of the computer using System Restore Points. The ransomware operators purposefully eliminate Windows OS-based methods that could assist the victim in file restoration without payment. Furthermore, the perpetrators modify the Windows HOSTS file by appending a list of domains and associating them with the localhost IP address. Consequently, when attempting to access any of the blocked websites, the victim encounters a DNS_PROBE_FINISHED_NXDOMAIN error.

It is worth noting that the ransomware endeavors to block websites that provide various how-to guides for computer users. Evidently, by restricting specific domains, the criminals aim to hinder the victim’s access to relevant and helpful information regarding ransomware attacks. Additionally, the virus deposits two text files on the victim’s computer containing pertinent details about the attack: the victim’s public encryption key and personal ID. These files are named bowsakkdestx.txt and PersonalID.txt.

Even after implementing these modifications, the malware does not cease its activities. Variants of the STOP/DJVU ransomware often deploy the Vidar password-stealing Trojan on compromised systems. This particular threat possesses an extensive range of capabilities, including:

• Stealing login credentials for Steam, Telegram, and Skype;
• Pilfering cryptocurrency wallets;
• Downloading and executing malware on the infected computer;
• Extracting browser cookies, saved passwords, browsing history, and other sensitive data;
• Viewing and manipulating files on the victim’s computer;
• Enabling remote access for hackers to perform various tasks on the victim’s computer.

The DJVU/STOP virus employs the AES-256 cryptography algorithm. It supposes that there are 2^256 possible decryption keys. Simply put, if your files have been encrypted with a unique online decryption key, it becomes utterly impossible to decrypt them without that specific key.

Once Ahgr operated in online mode, obtaining access to the AES-256 key is unattainable. This key is stored on a remote server controlled by the criminals responsible for distributing this ransomware. To obtain the decryption key, a payment of $980 is required. The victims are instructed to contact the fraudsters via email ([email protected]) to receive the payment details.

The message by the ransomware states the following information:

ATTENTION!

Don't worry, you can return all your files!

All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.

What guarantees you have?

You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.

You can get and look video overview decrypt tool:

https://we.tl/t-WJa63R98Ku

Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.

Please note that you'll never restore your data without payment.

Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:

[email protected]

Reserve e-mail address to contact us:

[email protected]

Your personal ID:
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Do not pay for Ahgr!

Please, try to use the available backups, or Decrypter tool

The _readme.txt file also states that computer owners should contact the Ahgr representatives within 72 hours from the time their files were encrypted. By doing so, users will receive a 50% rebate, reducing the ransom amount to $490. However, I strongly advise against contacting these fraudsters and making any payments.

One of the most effective solutions to recover the lost data is to utilize available backups or employ a Decrypter tool.

It’s worth noting that viruses of this nature follow a similar set of actions to generate a unique decryption key for data recovery. Unless the ransomware is still in the development stage or has significant flaws that are difficult to trace, manual recovery of encrypted data is not feasible. Regularly backing up your critical files is the only reliable solution to prevent data loss.

Keep in mind that even if you maintain regular backups, they should be stored in a separate location, not connected to your primary workstation. For example, you can store backups on a USB flash drive, an external hard drive, or utilize online (cloud) storage services.

It’s important to note that if you store your backup data on your primary computer, it may also become encrypted like the rest of your data. Therefore, storing the backup on the same device is not a wise decision.

How I was infected?

Ransomware has a various methods to built into your system. But it doesn’t really matter what concrete method had place in your case.

Ahgr virus attack following a successful phishing attempt.

How To Remove Ahgr Ransomware?

In addition to encode a victim’s files, the Ahgr infection has also started to install the Vidar Stealer on system to steal account credentials, cryptocurrency wallets, desktop files, and more.³

Reasons why I would recommend GridinSoft⁴

1. Run the setup file.

   
   

2. Press “Install” button.

   

3. Once installed, Anti-Malware will automatically run.

   

4. Wait for complete.

   

5. Click on “Clean Now”.