Geek's Advice

GUJD ransomware seeks to take your files hostage by encrypting them

GUJD ransomware is a dangerous menace to your computer as it is a new variant of STOP/DJVU file-encrypting virus. Once launched on the target system, it encrypts all files using RSA Salsa20 algorithm nd also marks them with .gujd extensions. To inform the victim about the attack, the virus drops _readme.txt file in every effected data folder. The criminals demnd paying a ransom for GUJD file decryption, and the price of it depends on how quickly the victim manages to settle an agreement with the attackers (and transfer the money). The note specifies that the victim has to write to cybercriminals within 72 hours from the infection timestamp to secure a $490 deal for file decryption, or it will cost $980 later. Two emil addresses provided by the note are manager@mailtemp.ch and helpmanager@airmail.cc, and these are the only contacts that the attackers leave behind them.

The primary aim of GUJD ransomware is to use military-grade encryption algorithms which ensure that the data on victim’s computer becomes impossible to open. It must be said that the virus encrypts only the first 150 KB of each file, therefore some of formats can still be repaired with some data loss at the beginning of the file. However, the rest of the data becomes unusable and the criminals expect that the victim will try to pay the ransom for data decryption. The _readme.txt note explains the pricing scheme for the decryption software and unique key – it costs $490 if paid within 3 days or $980 later. After contacting the criminals, the victim willl find out that the attackers want to receive the payment in cryptocurrency (Bitcoin). Such transactions cannot be traced down and therefore helps to keep the attackers anonymous.

Although cybercriminals suggest to provide you ‘test decryption’ service, our team as well as FBI advise NOT to pay the ransom. There are a number of reasons not to do so. Some of them are listed below:

• No one guarantees that you will receive decryption tool after paying the ransom, even if the criminals say so. They cannot be tracked down, therefore if you decide to transfer your money to them, you take the risk of losing your money in addition to already encrypted files.
• Actors behind the ransomware attacks earn millions of US dollars each year. We strongly suggest you to not contribute to the growth of this number since it also means that cybercriminals can expand their operations and employ more people for malware development and distribution.
• Paying a ransom might be considered an illegal act in your country.
• Malware that comes from STOP/DJVU ransomware family such as GUJD virus run AZORULT Trojan on infected systems.

Ransomware-related damage explained: what has been done to your computer?

GUJD ransomware begins the attack by running a file-encrypting process that starts scanning all system folders and encrypting files on them. Next, the virus runs a fake Windows update prompt called winupdate.exe, which is designed to deceive the victim and justify a sudden system slowdown. In addition to this, the ransomware also runs the following task in Command Prompt to delete Volume Shadow Copies from the system:

^{vssadmin.exe Delete Shadows /All /Quiet}

Deleting those copies means the victim won’t be able to restore corrupted data using System Restore Points. In other words, the virus tries to block all possible ways of restoring data for free. What the virus also doesn’t want the victim to do is access websites that provide relevant attack-related information or general information about ransomware viruses, so it adds a list of domains to Windows HOSTS file and maps them to victim’s localhost IP. As a result, the victim runs into DNS_PROBE_FINISHED_NXDOMAIN error (see this guide on how to remove blocked domains list manually) everytime one tries to access one of the blocked websites directly or via search engine.

The ransomware also drops bowsakkdestx.txt (contains victim’s public encryption key and personal ID) and PersonalID.txt files on computer among other files required to perform malicious operations. You can see an example of such file contents down below.

As mentioned earlier, GUJD virus tends to drop password-stealing Trojan on victim’s computer. This Trojan is called AZORULT and it can also be used as a remote access tool by the attacker who controls it. The list of functionalities it provides for the criminals is lengthy and allows the criminal to do the following tasks:

• Download additional viruses and spyware to the computer and run them;
• Steal various login credentials, including those of Steam or Telegram;
• View or delete files from victim’s computer;
• Steal cryptocurrency wallets;
• Steal browser cookies, saved passwords, browsing history and more.

Due to all the reasons we discussed, we strongly recommend you to remove GUJD ransomware virus as soon as possible. For that, we suggest you to consider investing in a obust antivirus software with real-time protection, such as INTEGO Antivirus. Additionally, to repair virus damage on Windows OS files (including modified HOSTS file) we recommend scanning with RESTORO.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Ransomware distribution techniques to be aware of

Ransomware-type computer viruses are mainly distributed either via illegal online downloads (such as movie torrents, game or software cracks and similar), malicious email attachments or vulnerabilities in the target system. The most popular ones are illegal torrent downloads and email malspam campaigns, so we’ll focus on these two.

Almost all STOP/DJVU variants including GUJD virus are distributed in a form of illegal software cracks or keygens. In other words, the ransomware operators pack malicious scripts that are meant to download and run the virus from a remote location into safe-looking software cracks and upload them to various file sharing sites. The primary targets are people who are trying to activate paid software licenses for free. The worst part is that such people are often willing to ignore their security software warnings about a potentially malicious download and proceed to open the file anyway. Victims of this ransomware strain have reported various programs that they attempted to download illegally and got the infection immediately. Keep in mind that this is not a complete list and the malware might await in other software variants as well (do not forget to report it to us so we could update the list):

• Adobe Photoshop;
• Corel Draw;
• Cubase;
• Adobe Illustrator;
• Windows activation tools such as KMSPico.

We’d also like to advise you to avoid such downloads altogether. Even if you managed to install your desired software successfully and everything seems normal, keep in mind that your computer might already be infected with silent malware such as cryptocurrency miners, Trojans or other threats that do not directly show their presence. In order to avoid such computer infections, make sure you only get your programs from legitimate sources.

Another malware distribution technique actively used for ransomware transmission is malicious email spam. For this technique to work, the criminals compose convincing messages along with some kind of document or another file attached to it. The file usually arrives in DOCX, XLS, PDF or another format and can be named somewhat safe-looking, such as invoice/payment details/parcel tracking details/order summary or similar. The message usually invites the victim to review attached contents and/or modify them and reply to the sender as soon as possible. However, if the victim opens such file and disables Secure Mode to edit the file, the hidden script in the file can immediately connect to a remote server and downlaod the payload. For this reason, we strongly suggest that you only open emails that you waited for and know they’re 100% secure. In addition, we strongly advise to learn about email spoofing techniques, which help the attackers to showcase a fake sender’s email address to you.

One final ransomware distribution technique you must know if you’re victim of STOP/DJVU variant is this one: operators of other ransomware strains are injecting different viruses to fake STOP/DJVU decryption tools and advertising them online. For example, if you happen to come across such fake tool and download it, your files will get double-encrypted with a different ransomware such as ZORAB.

Remove GUJD ransomware virus and decrypt/repair your files

Remove GUJD ransomware virus along with any additional malware that landed on your computer during the cyber attack. To professionally cleanse your computer, you do not need a technician’s help, only the free tutorial provided below. We strongly suggest scanning with robust antivirus such as INTEGO Antivirus to eliminate malware and secure your computer with real-time protection and defense against malicious downloads, then scan with RESTORO to repair virus damage on Windows OS files.

After a successful GUJD ransomware virus removal, consider taking the following steps:

• Register a cybercrime incident case to your local authority responsible for handling such casess.
• Use data backups to restore as many files as possible.
• Follow the given instructions to decrypt or repair files affected by STOP/DJVU versions.
• We also recommend changing your passwords, especially for sites that you chose to save login credentials for in your browser.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.