Geek's Advice

CUAG ransomware strikes unprotected computer systems to encrypt all files

CUAG ransomware is a new malicious file-encrypting virus that emerged from the infamous STOP/DJVU ransomware group. Just like the others before it, this latest entrant is notorious for compromising files saved in computers it compromises by encrypting them and appending .cuag extension to each of them. What this means is that a file that was initially saved as 1.jpg is automatically renamed 1.jpg.cuag and the same format is applied to all others. Also, while the attack is still ongoing, this emergent ransomware would release certain ransom notes known as _readme.txt in all the folders. Contained in the ransom notes are notifications from the cybercriminals about the attack and why the victim should pay ransom fees in exchange for CUAG decryption tool they would promise to provide.

They will further claim that CUAG ransomware virus has seized control of the victim’s entire database as contained in the computer and also made use of a powerful encryption key to lock it, based on that, if the victim hopes to ever retrieve the encrypted files, they must have to pay certain fees as ransom to those behind the attack. To facilitate the payment process, two email addresses (support@sysmail.ch and helpsupportmanager@airmail.cc) will also be dropped so the victim will be able to communicate with them.

Other pieces of information that are contained in the ransom notes include their so-called decryption service prices as well as terms and conditions of payment. The cybercriminals will emphasize that payment should be made ASAP and to encourage that, they will state that complying within 72 hours/3 days would earn the victim 50% discount. In other words, instead of having to pay the full ransom fee of $980, they would now pay $490, but once the “grace period” elapses, only full payment would be acceptable.

However, the moment their victim reaches out to them with intent to pay, they would emphasize that only payments made with cryptocurrency would be acceptable to them. Thus they would forward a wallet address to the victim and instruct them to pay the equivalence of the ransom fee into it. The apparent reason why they usually opt for this channel of payment is because of the anonymity it provides, unlike other means of payment that could be easily traced to them by law enforcement agents. The cybercriminals sometimes request for excerpts of the encrypted files from their victims for them to decrypt as a way of proving their capability to restore the entire files once payment is made but will be quick to warn that such excerpts must not contain information that would be perceived as vital.

Whatever be the case, our cybersecurity experts have a standard policy that victims SHOULD NOT PAY RANSOM, and this recommendation is similar to the FBI’s guidelines concerning cybercrimes/ransom payment. Victims should understand that paying ransom to cybercriminals does not guarantee file recovery. Also, paying such huge amounts of money to cyber criminals would only encourage them to expand their rogue operations and victimise more people.

There are other information-stealing Trojans computer users should be wary of, they include VIDAR and AZORULT, and they are often spread disguised as decryptors. They are notorious for covertly stealing sensitive data such as software login details, banking details, saved passwords, cryptocurrency wallets, browsing history, etc. Remember that such sensitive information in the wrong hands can lead to blackmail and other criminal activities.

Victims of STOP/DJVU are hereby advised to remove CUAG ransomware virus from their infected computer without further delay. They can get this done by setting up their computer in Safe Mode with Networking option before activating any good antivirus to detect and safely remove every trace of malware that could be found in the compromised computer. You can always make use of any antivirus you fancy, but it is essential to ensure it is strong enough. However, our experts recommend INTEGO Antivirus because they’ve certified it to be an excellent computer protection software. In addition, you can also download RESTORO to aid in repairing Windows OS files damaged by the virus.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Ransomware distribution techniques you should beware of

From a general perspective, computer systems are often infected by STOP/DJVU ransomware versions such as CUAG virus after its user downloads malicious software contents from online torrents. Cybercriminals make use of such online torrents platforms as a hideout where they upload malware-laden pirated software copies. When users download such contents in the form of “cracks” or key generators, they unwittingly trigger ransomware attack.

Over time, lots of victims have reported a diverse array of software contents as often used by the cybercriminals. They include illegal activation tools, “cracks”, famous but pirated software games and utilities etc. Some of the most common ones uploaded on online torrents platforms are listed below:

• Cubase;
• Corel Draw;
• Tenorshare 4ukey;
• AutoCad;
• Opera browser;
• Fifa 20;
• VMware Workstation;
• Adobe Photoshop;
• Adobe Illustrator;
• League of Legends;
• Internet Download Manager;
• KMSPico (illegal Windows activation tool).

For those that purposely or ignorantly visit such dangerous online torrents platforms, it is high you totally desist from such risky behavior. You could become a victim of ransomware attack any moment you’re on such platforms, aside that, it is also considered as a criminal offence and such person could be prosecuted under the existing copyright infringement laws. Therefore, instead of engaging in such unethical practices fraught with danger, it is a lot better to get such software contents from the legitimate/authorized platforms, and by so doing, you will be helping the IT industry to grow. Moreover, you won’t be at risk of losing critical data or being asked to pay outrageous fees as ransom.

Another avenue cybercriminals use in spreading ransomware is through malicious email attachments. In this method, they would create believable messages and would attach documents crafted on PDF, XLS or DOCX among other similar formats. These messages would be disguised as coming from loved ones or even popular brands like Amazon, FedEx, DHL, eBay, UPS etc.

In their desperation to deceive their target victims, they would also attach files with compelling names such as Order Summary, Invoice or Tracking Details among similar ones. Sometimes, they opt for the use of email spoofing techniques to obfuscate their real address. Whichever one they chose, you’re advised to apply desecration when opening emails, especially the ones you weren’t expecting. If you have any doubt concerning any email that pops up in your inbox, you consider it a a red flag and thread carefully.

Many computer users tend to throw caution to the wind when they fall victim to STOP/DJVU ransomware variants and wouldn’t mind seeking for solutions even from suspicious websites. This is a wrong approach to take because such sites hardly provide any actual help. Worse still, they’re owned by crooks seeking to further scam you. Some of them equally spread other versions of ransomware like ZORAB disguised as so-called STOP/DJVU decryptor and downloading them can lead to double-file encryption.

More information concerning the malware

This section talks about the technical aspect of what transpires during CUAG ransomware attack. The first thing the malware does is to launch what is known as build.exe or build2.exe executables which would be accompanied by winupdate.exe (the prompt that triggers fake Windows update screen). It then makes a connection with https[:]//api.2ip.ua/geo.json and forwards the outcome to geo.json file. The malware then gathers information about your computer such as its geolocation, latitude and longitude, time zone, and zip code. It will also create another file that will contain hardware details, installed software list and forwards them to information.txt.

The image below shows some typical examples of geo.json file.

See an example of information.txt file below.

With the details it obtained above, the malware will profile the country code against a list containing some Eastern European and Middle East countries which they designated as encryption-protected nations. They are Russia, Ukraine, Uzbekistan, Syria, Kyrgyzstan, Belarus, Kazachstan, Tajikistan and Armenia. If the malware detects that the computer is domiciled in any of the countries, it will instantly abort its operation. But if otherwise, it will move to the next stage where it will obtain online encryption key from their server and combines it with the victim’s ID before sending them to bowsakkdestx.txt file and to PersonalID.txt file. Shown in the diagram below are examples of these files.

In a situation where the virus couldn’t extract any online encryption ID, it will opt for the use of an offline encryption ID. The difference between the two ID’s is that online ID is unique for each victim while offline ID is uniform for all victims of the same virus variant. What shows whether an offline key was used is the presence of t1 characters appearing at the end of the victim’s personal ID. The implication is that such .cuag encrypted files could be decrypted going forward. More details about is provided below.

Afterwards, the ransomware would begin full data encryption by scanning the folders and encrypting the files with Salsa20. It will then lock it using RSA-2048 encryption key. Meanwhile, it will simultaneously mark the files with more extensions.

Here is a screenshot of _readme.txt ransom note that is left in all folders.

The next thing the virus does is to delete Volume Shadow Copies using the Command Prompt task displayed here:

^{vssadmin.exe Delete Shadows /All /Quiet}

To complete the entire process, the virus would add some blacklisted domains to the Windows HOSTS file and attaches them to the localhost IP, thus preventing access to the blacklisted websites. Whenever the victim tries to gain access to the websites, DNS_PROBE_FINISHED_NXDOMAIN error will pop up. The criminals usually do this to prevent the victim from getting help online.

Remove CUAG Ransomware Virus and Recover Your Files

As stated earlier, victims of ransomware should not pay ransom to cybercriminals but instead follow the steps outlined below in order to effectively remove CUAG ransomware and prevent any further damage/losses.

Steps to take after CUAG ransomware virus removal:

• Use any available backup device to restore lost data;
• Report to the nearest local law enforcement agent and inform them accordingly;
• Change all passwords associated with the compromised computer;
• Learn possible ways STOP/DJVU variants could be decrypted.

The guide provided below will assist you when using Safe Mode with Networking option to your computer. Once it is set up using this option, it becomes easier for the antivirus to function at its optimal capacity. However, it is also essential to make use of only tested and trusted antivirus software such as INTEGO Antivirus in order to achieve great results and ensure complete computer protection.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.