Geek's Advice

CKAE ransomware threatens to keep your files encrypted if you refuse to pay up

CKAE ransomware is a newly emerged malicious file-encrypting malware from the notorious STOP/DJVU ransomware group. Just like the other variants before it, this virus functions by encrypting files contained in any computer it infects and also appends them with .ckae extension. For instance, a file that was known as 1.jpg prior to its infiltration will be renamed 1.jpg.ckae and the same format will be replicated on all other data. Also, while this is still ongoing, a ransom note called _readme.txt will be dropped in every folder. These ransom notes carry a message from the cybercriminals informing the victim about the computer virus attack and the need for them to contact those behind it in order to pay ransom in exchange for a promised CKAE file decryption tool.

They will reiterate that CKAE ransomware virus has encrypted their entire database, thereby rendering all files useless, including important documents, pictures, data etc. They will claim that a very strong and unique encryption key was used. In other words, there is no other way they could get around it except by paying ransom to cybercriminals. To facilitate further discussions, they will drop two email addresses: support@sysmail.ch and helprestoremanager@airmail.cc.

Also included in the information would be decryption service prices and terms of payment. They will notify the victim that how much they would pay depends on how fast they’re able to comply. For instance, if they desire to pay only 50% of the total cost of ransom, then payment must be made within 72 hours/3 days max. Therefore, they would have to pay $490 only but once 72 hours elapses, only the full payment of $980 would be acceptable.

However, once the victim reaches out to them, he would be informed that payment can only be made by purchasing cryptocurrency that is worth the ransom fee and transferring same to a wallet address they would make available. They usually make use of such payment option because of the anonymity it provides. They consider other payment channels too risky and easily traceable by law enforcement agents who may come after them. To convince the victim that all encrypted files will be restored by them once payment is made; they may request for excerpts of the encrypted files to be forwarded to them for test decryption but will also make it clear that such excerpts must not contain information that could be seen as valuable to the victim.

Regardless of what the cybercriminals are saying, our cybersecurity experts advise that victims SHOULD NOT PAY RANSOM and this standpoint is similar to FBI’s guidelines relating to ransom payments. The reason is that there is no guarantee that files will be restored even after paying the ransom. Also, paying the ransom would put more funds in the hands of cybercriminals, thus enabling them to employ more rogue developers to victimize more people. In addition to the two reasons already mentioned, paying ransom in any form is illegal.

Cybercriminals equally drop other Trojans like AZORULT and VIDAR which they use to steal sensitive information such as banking details, software account credentials, cryptocurrency wallets, and saved passwords. Such sensitive information in the hands of cybercriminals will open new fronts for stealing or blackmail.

Computer users that are already infected with any variant of STOP/DJVU including the one being reviewed should remove CKAE ransomware virus from their computer without further delay. This can be effectively done by setting up the infected computer in Safe Mode with Networking before running any strong antivirus on it. It is important to ensure that only genuine antivirus software is used. If you are not sure of the antivirus to use, we recommend INTEGO Antivirus because it has proven to be very strong and reliable. You should also consider downloading RESTORO to help you repair Windows OS files that were damaged by the virus.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Ransomware distribution methods used by cybercriminals

The most common method cybercriminals use in distributing STOP/DJVU ransomware variants including the nascent CKAE virus is through downloads of malicious software contents from online torrents. They often hide malware in pirated software copies including the so-called “cracks” and key generators, so when unsuspecting users download them in their PC, they end up triggering ransomware attack. Reports have shown that victims usually noticed their computers became compromised after downloading certain pirated software contents from online torrents platforms. They were deceived by cybercriminals who uploaded such contents as license activation tools or “cracks” to enable bypass the copyrighted genuine ones without paying the requisite fees. These fake software contents are nothing but baits used in getting their victims. Some of the most popular ones are listed below:

• Adobe Photoshop;
• KMSPico (illegal Windows activation tool);
• Tenorshare 4ukey;
• AutoCad;
• Opera browser;
• Corel Draw;
• VMware Workstation;
• Cubase;
• Adobe Illustrator;
• League of Legends;
• Internet Download Manager;
• Fifa 20;
• Various AV software.

As can be deduced thus far, going to online torrents platform to download software contents is indeed a very bad idea and anyone involved in such habit should stop it immediately for their own good. Otherwise, they could become victims of ransomware attack. Also, such illegal download of copyrighted software contents is against the law and perpetrators are liable to be prosecuted accordingly. Instead it is advisable to do the right thing by downloading needed software contents from official channels and also paying the requisite fees attached to them. Whatever amount that is paid for it can’t be compared to the mind boggling ransom fees cybercriminals usually demand from their victims and neither would there be any risk of losing important/sensitive data.

In addition to online torrents platforms, cybercriminals also make use of malicious email attachments in distributing ransomware. In this method, they would compose ordinary-looking but believable messages while impersonating legitimate brands or individuals. They would make use of DOCX, PDF or XLS among similar formats in composing such messages because they enable JavaScript and macro functions for downloading payloads and triggering them in random computers.

Because of the extent they go in faking their emails to appear exactly like those they’re impersonating, it has become quite difficult for individuals to easily tell apart if an email is genuine or not. They usually use popular brand names like eBay, DHL, Amazon, or UPS and would give the attachments compelling names like Tracking Details, Invoice and Order Summary, etc. Conversely, they may even decide to use email spoofing techniques in obfuscating that actual originating email address. Whatever method they use, it is advisable to apply caution when an unexpected email lands in the inbox or spam.

Be that as it may, victims of STOP/DJVU ransomware variants should not visit suspicious websites that make bogus claims of offering decryption services because, more often than not, they’ve been found to be dubious, and their intention is to further scam the victims by spreading other ransomware versions like ZORAB. At the moment, only DiskTuna and Emsisoft offer decryption/data repair tools that are reliable.

More important information concerning the infection

This section covers the technical aspect of the malware and how much a PC could be affected during CKAE ransomware attack. Firstly, the malware would set up build.exe or build2.exe executables as well as winupdate.exe. Afterward, it will connect to https[:]//api.2ip.ua/geo.json while saving the outcome in geo.json file. It then proceeds to information gathering about every relevant detail concerning the computer. The computer’s geolocation, time zone, zip code, latitude and longitude, and stores them in the geolocation file before creating another file where hardware details, software list and active processes would be stored in information.txt. An example is provided below showing geo.json file.

See a screenshot of information.txt file below.

Using the geolocation details, the malware would make a comparison between it and their list of encryption exempted countries, namely: Ukraine, Russia, Syria, Armenia, Tajikistan, Ukraine, Kazachstan, Kyrgyzstan, Belarus and Uzbekistan. If it indicates positive to any of the listed countries, they would instantly abort their mission but otherwise, they would move to the next stage by fetching online encryption key from their central server and merging it with the victim’s ID before saving it in the bowsakkdestx.txt file and to the PersonalID.txt file. Displayed below are examples of such files.

In situations where it fails to extract online encryption key, it will settle for the use of an offline encryption key, and the latter is uniform for all victims of the same variant. The appearance of t1 characters suffixed to a victim’s personal ID is an indication that offline key was used, and it raises hope of decrypting .ckae files going forward. More information about this is provided below.

The ransomware would at this point commence full data encryption by scanning all folders and encrypting them with Salsa20 before locking it with the RSA-2048 key. While this is ongoing, the malware will mark each file with .ckae extension.

Shown in the screenshot below is an example of the _readme.txt ransom note that is left in all folders.

The next thing the virus does is to delete all Volume Shadow Copies by making use of the command prompt as shown below:

^{vssadmin.exe Delete Shadows /All /Quiet}

Lastly, the malware would compile a list of domains that would be sent to the Windows HOSTS file and mapped to the localhost IP. This action will automatically prevent the victim from having any access to the blacklisted sites and the DNS_PROBE_FINISHED_NXDOMAIN error message might appear on the screen whenever they make any attempt. Why they do this is to preempt any move by the victim to seek online help from certain websites that offer it.

The virus would equally drop more malware such as AZORULT or VIDAR on the already infected PC.

Remove CKAE Ransomware Virus and Recover Your Files

Victims of this malware variant are advised to remove CKAE ransomware virus without further delay. This can be effectively done by booting the infected PC using the Safe Mode with Networking option before running genuine antivirus software on it. This option is highly recommended because it will free up space in the computer and enable the antivirus to remove every trace of the malware. If you can’t decide on which AV to use, we highly recommend INTEGO Antivirus. We also recommend using RESTORO to repair virus-affected Windows OS files. Afterward, the victim should follow the steps outlined below:

• Inform relevant local authorities about the ransomware attack.
• Make use of any backup device to restore lost files.
• Learn possible ways variants of STOP/DJVU encrypted files could be decrypted.
• Change all passwords that were used on the compromised computer.

Being proactive and avoiding activities that could put you at risk of ransomware attacks is the best thing to do. However, anyone whose PC became infected for one reason or another should equally follow the steps recommended in this article.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.