WAYN Virus File Decrypt & Removal

While analyzing malware samples submitted to VirusTotal¹, I discovered the Wayn ransomware, a member of the STOP/Djvu ransomware family, encrypting files and appending the “.wayn” extension to their original filenames. For example, a file originally named “a.jpg” would be renamed as “a.jpg.wayn“, while “b.doc” would transform into “b.doc.wayn“.

Wayn is a member of the Djvu malware family, which is notorious for its connection to other malicious software like RedLine Stealer and Vidar. These additional malware strains are specifically designed to steal sensitive information from compromised systems. Cybercriminals have been observed distributing ransomware from the Djvu family in conjunction with these harmful programs.

I have compiled an extensive list of potential solutions, tips, and best practices to neutralize the Wayn virus and recover encrypted files. Depending on the circumstances, file recovery may be either straightforward or impossible.

The Wayn ransomware employs a unique key for each victim, with one exception:

• If Wayn fails to establish a connection with the command and control server (C&C Server) before initiating the encryption process, it resorts to the offline key. This particular key is shared among all victims, offering the possibility of decrypting files affected by a ransomware attack.

What is Wayn virus?

☝️ It can be correctly identify as a STOP/DJVU ransomware-type infection.

The Wayn ransomware is a kind of threat that encrypted your files and then forces you to pay to restore them. The image below gives a clear vision of how the files with “.wayn” extension look like:

Wayn File (STOP/DJVU Ransomware)

This message asking payment is for restore files via decryption key:

_readme.txt (STOP/DJVU Ransomware) – The scary alert demanding from users to pay the ransom to decrypt the encoded data contains these frustrating warnings

Wayn ransomware operates by employing a set of processes to carry out different tasks on the victim’s computer. One of the first processes launched is winupdate.exe, which displays a counterfeit Windows update prompt during the attack. This deceptive tactic aims to convince the victim that a sudden system slowdown is caused by a Windows update. Simultaneously, the ransomware initiates another process (usually named with four random characters) that scans the system for target files and encrypts them. Furthermore, the ransomware deletes Volume Shadow Copies from the system using the following CMD command:

vssadmin.exe Delete Shadows /All /Quiet

Once deleted, restoring the previous state of the computer becomes impossible using System Restore Points. The ransomware operators deliberately eliminate any Windows OS-based methods that could assist the victim in file restoration free of charge. Additionally, the criminals modify the Windows HOSTS file by adding a list of domains and mapping them to the localhost IP. Consequently, when attempting to access any of the blocked websites, the victim encounters a DNS_PROBE_FINISHED_NXDOMAIN error.

We observed that the ransomware deliberately blocks websites that publish various how-to guides for computer users. It is evident that by restricting specific domains, the criminals attempt to hinder the victim’s access to relevant and helpful information regarding ransomware attacks. The virus also saves two text files on the victim’s computer, containing attack-related details: the victim’s public encryption key and personal ID. These files are named bowsakkdestx.txt and PersonalID.txt.

Even after these modifications, the malware does not cease its activities. Variants of STOP/DJVU ransomware often deploy the Vidar password-stealing Trojan on compromised systems. This threat possesses an extensive range of capabilities, including:

• Stealing Steam, Telegram, Skype login/password credentials;
• Stealing cryptocurrency wallets;
• Downloading and executing malware on the computer;
• Stealing browser cookies, saved passwords, browsing history, and more;
• Viewing and manipulating files on the victim’s computer;
• Enabling hackers to remotely perform various tasks on the victim’s computer.

The DJVU/STOP ransomware family employs the AES-256 cryptographic algorithm. Consequently, if your data has been encrypted with a unique online decryption key, it becomes impossible to decrypt the files without that specific key.

In the event that Wayn operated in online mode, gaining access to the AES-256 key is unattainable. The key is stored on a remote server controlled by the criminals who propagate the ransomware.

To obtain the decryption key, a payment of $980 is required. The victims are instructed to contact the fraudsters via email ([email protected]) to receive payment details.

The message by the ransomware states the following information:

ATTENTION!

Don't worry, you can return all your files!

All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.

What guarantees you have?

You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.

You can get and look video overview decrypt tool:

https://we.tl/t-WJa63R98Ku

Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.

Please note that you'll never restore your data without payment.

Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:

[email protected]

Reserve e-mail address to contact us:

[email protected]

Your personal ID:
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Do not pay for ransom!

Please, try to use the available backups, or Decrypter tool

The _readme.txt file instructs computer owners to contact Wayn representatives within 72 hours of their files being encrypted. It promises a 50% rebate if contacted within this timeframe, reducing the ransom amount to $490. However, it is strongly advised not to pay the ransom.

I highly recommend that you refrain from contacting these fraudsters and avoid making any ransom payments. One of the most effective solutions to recover lost data is to utilize available backups or use a decryption tool like Decrypter from Emsisoft.

It’s important to understand that ransomware viruses, including Wayn, employ a similar process to generate a unique decryption key for recovering encrypted data. Unless the ransomware has significant flaws or is still in the development stage, manual recovery of the encrypted data is not possible. Regularly backing up your critical files is the best way to prevent the loss of valuable data.

Remember that even if you maintain regular backups, they should be stored in a separate location and not connected to your main workstation. This could be a USB flash drive, an external hard drive, or an online (cloud) storage service. Storing backups on your main PC is not advisable, as they can also be encrypted along with other data in the event of an attack.

How I was infected?

Ransomware has a various methods to built into your system. But it doesn’t really matter what concrete way was used in your case.

Wayn virus attack following a successful phishing attempt.

However, there are several common methods through which the Wayn virus can infiltrate your PC:

• Hidden installation bundled with other applications, particularly utilities that are offered as freeware or shareware.
• Deceptive links in spam emails that lead to the installation of the virus.
• Utilizing online free hosting resources.
• Downloading pirated software from illegal peer-to-peer (P2P) resources.

In some cases, the Wayn virus may masquerade as a legitimate tool, such as through messages demanding unwanted software or browser updates. This is a tactic employed by online fraudsters to manipulate users into manually installing the ransomware.

Typically, the deceptive update alert will not indicate that it will result in the installation of the virus. It will be disguised as an alert prompting you to update Adobe Flash Player or another dubious program.

Using cracked apps or engaging in illegal P2P activities can also lead to damage and the injection of serious malware, including the Wayn ransomware.

To summarize, what can you do to prevent the infiltration of the Wayn ransomware into your device? While there is no foolproof method, here are some tips to reduce the risk of infection:

1. Exercise caution when installing free software and carefully read all the additional offers presented during the installation process.

2. Avoid opening suspicious email attachments and refrain from opening files from unknown senders.

3. Keep your security program updated at all times.

It’s important to note that the malware does not openly reveal itself and will not appear in the list of installed programs. Instead, it operates discreetly as a malicious process running in the background from the moment your computer is launched.

How To Remove Wayn Virus?

In addition to encode a victim’s files, the Wayn infection has also started to install the Vidar Stealer on system to steal account credentials, cryptocurrency wallets, desktop files, and more.

1. Run the setup file.

   
   

2. Press “Install” button.

   

3. Once installed, Anti-Malware will automatically run.

   

4. Wait for complete.

   

5. Click on “Clean Now”.