Geek's Advice

HGSH ransomware is a dangerous computer virus that encrypts data

HGSH ransomware is a dangerous malware that functions by encrypting files contained in any computer it compromises, and also appends .hgsh extension to each file name. To have a clearer picture of this, a file formerly named 1.jpg will automatically be renamed 1.jpg.hgsh and same process is repeated on all others. While the attack is still ongoing, _readme.txt ransom notes will be released in every folder. These _readme.txt ransom notes contain direct message from the cybercriminals instructing the victims on how to get in touch with them and pay a certain amount of money as ransom before they would be given HGSH decryption tool.  

They will emphasize that HGSH ransomware virus has compromised their computer and equally encrypted the entire files contained in it, such as pictures, important data, documents etc. And since they made use of very strong encryption key, there is no other way they can possibly retrieve their data unless they pay a stipulated amount of money as ransom. Also contained in it will be two email addresses (manager@mailtemp.ch and helpsupportmanager@airmail.cc.) left for the victim to contact them with.

In order to influence the victim into paying the ransom demand as soon as possible, they will give a condition that if the victim could pay within the next 72 hours or 3 days, they will slash the ransom demand by 50%, thus instead of paying $980 to have their encrypted files decrypted, they will now have to pay $490. However, once 3 days elapses, they would be made to pay the full ransom demand.

If the victim reaches out to them, they will inform him that payment can only be made through cryptocurrency. Therefore, they would have to the cryptocurrency equivalent of the amount into a particular wallet address they will provide. The reason for using this channel is to enable the cybercriminals to remain anonymous and evade possible tracking and arrest by law enforcement agencies. To impress the victim and gain their confidence, they may request for excerpts from the encrypted files so they can decrypt as sample. However, they will warn that such excerpt must not contain any information that could be perceived as important to the victim.

Regardless of how important the encrypted data is, our in-house experts recommend that victims shouldn’t pay the ransom, and this position is in line with FBI’s recommendation regarding payment of ransom. Note that paying ransom does not guarantee that the cybercriminals will restore your encrypted data. Moreover, complying with their demand will only increase their income and encourage them to continue constituting nuisance and victimizing others. In addition to that, the virus is also known to release Trojans such as AZORULT and VIDAR on the compromised computer for the purposes of stealing information, like your banking details, software account login details, saved passwords, cryptocurrency wallets and browsing history. With such sensitive information in the hands of cybercriminals, issues such as blackmail or loss of other valuables become a possibility. 

Victims of any STOP/DJVU variant attack should remove HGSH ransomware virus from their computer as soon as they can. They can do this by running a reliable antivirus while setting up your computer on Safe Mode with Networking. Using this set up is good to ensure the antivirus functions optimally in removing all trace of the virus in your computer. If you’re not sure on what antivirus to use, our team recommends INTEGO Antivirus. Additionally, you may want to download and run RESTORO, a tool that can identify virus damage on Windows OS files for free. To repair it, you may need to purchase its full version.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Techniques used in distributing ransomware

The most common way STOP/DJVU ransomware variants such as HGSH virus are spread is through download of malicious torrents. The virus will often hide in non-genuine software contents such as “cracks” or key generator and once opened by unsuspecting users, they will trigger malware infection. Based on data tallied over the years, many victims had reported of such ransomware attack after downloading certain software contents from online torrent platforms, after being deceived that such illegal activation tools and “cracks” could be accessed without following due process. Some of the fake versions of popular software copies often used by the cybercriminals are listed below: 

• League of Legends;
• Fifa 20;
• Tenorshare 4ukey;
• AutoCad;
• Opera browser;
• Corel Draw;
• VMware Workstation;
• Cubase;
• Adobe Illustrator;
• Adobe Photoshop;
• Internet Download Manager;
• KMSPico (illegal Windows activation tool).

As you can see, going to torrents online to download copyrighted software contents is risky and not worth the effort. Instead of getting what you need without paying the legal price as those rogue platforms promise, you only end up making yourself vulnerable to ransomware attack. Likewise, when you try to obtain other people’s product without paying the statutory price, it could be termed a criminal act and would be subject to prosecution. Therefore, it is always advisable to follow the right channel as promoted by the legitimate brand owners and pay the price attached to it. Remember that getting the software contents you need the right way will protect you from possible ransomware attack that would potentially cost you hundreds of dollars as well as loss of vital/sensitive data. 

Aside online torrent libraries, another prolific way cybercriminals distribute ransomware is through malicious email attachments. They will compose messages that will appear real, often using DOCX, PDF or XLS. Why they normally chose such platforms is because they allow JavaScript as well as other macro function both of which can effectively enable the storage of payload and its activation in any computer. 

However, it can be quite difficult to tell if an email is genuine or not since the cybercriminals have increasingly become more sophisticated in their approach. They often impersonate friends and family, colleagues or even popular brands. They may even attach a file and give it an irresistible name, for instance, they may present the email as coming from FedEx or DHL while the accompanying attachment may be named Invoice, Tracking Details or Order Summary. On the other hand, they may out-rightly decide to obfuscate the sender’s address by making use of email spoofing techniques. Either way, your curiosity may get the better of you to see what’s inside. However, you must apply extreme caution when faced with such dicey situation. 

For those that have fallen victims already, you may be tempted to go after certain websites that claim to provide decryption services but instead consider it as red flags because such solutions rarely exist. Also have it in mind that cybercriminals equally spread other versions of ransomware in the name of fake STOP/DJVU decryptors. Don’t think you have nothing more to lose because such fake decryptors can worsen the situation by doubly encrypting your files. 

More details about this file-encrypting malware attack

Oftentimes, victims tend to wonder the extent to which their computer was compromised during the HGSH ransomware attack. Actually, the first thing the malware does is to set up build.exe or build2.exe. Afterwards, it will connect to https[:]//api.2ip.ua/geo.json while saving the outcome to geo.json file. It then extracts all necessary information about the computer, particularly its zip code, geolocation, time zone, latitude and longitude, etc. These set of information would be sent to their main server. 

Shown below are two examples of geo.json files.

With the geolocation data, it will check if the computer is located in any of their encryption-exempted countries such as Kyrgyzstan, Ukraine, Russia, Syria, Uzbekistan, Kazachstan, Armenia, Belarus and Tajikistan. If it shows positive, they will immediately truncate their operations but if otherwise, they will move to the next stage. Now, it will get the online encryption from their server and combine it with the victim’s ID before saving it in the bowsakkdestx.txt file and to PersonalID.txt file.

A good example is displayed below.

If for any reason it couldn’t extract an online encryption ID, it will resort to the use of an offline one. The main difference is that unlike the online ID that is peculiar to each victim, the offline one is uniform for all. You can tell if an offline key was used if t1 characters appear at the end of the personal ID. This is a preferable option because it brightens the possibility of being able to decrypt .hgsh files. More details about it are provided in this tutorial.

At this point, the ransomware will commence full data encryption by scanning every folder and encrypting them with Salsa20 before using RSA-2048 to lock it.

Below is a sample of _readme.txt ransom note that is dropped in every folder.

The virus then deletes Volume Shadow Copies by leveraging a command prompt as shown here:

^{vssadmin.exe Delete Shadows /All /Quiet}

Additionally, this ransomware collects data about victim’s computer, such as hardware used, computer name, active processes and the list of installed software. The virus collects these details into information.txt file and sends it to its C&C server.

To complete the process, the virus now blacklists certain domains and adds them to Windows HOSTS file. This move is to prevent the victim from getting help online and when they try to visit any of those sites, DNS_PROBE_FINISHED_NXDOMAIN error message may appear on their screen. At this point, it may release more malware on the victim’s computer system.  

Remove HGSH Ransomware Virus and Recover Your Files

Victims of STOP/DJVU virus are advised to report the incident to relevant local authorities and also remove HGSH ransomware virus as fast as they can. You can avail yourself the guide below to learn how you can boot your computer using Safe Mode and Networking option. Our team recommends using professional software like INTEGO Antivirus and download RESTORO to see what virus damage on Windows OS files can be repaired.

Before we conclude, always remember the actions to take after any ransomware attack in order to limit the extent of damage. They include: informing relevant law enforcement agency nearest to you, making use of your backup to restore lost files (provided you have any but you must ensure the malware is totally removed), go for tutorials on how to repair files infected by STOP/DJVU, and finally change all passwords associated with the compromised computer. 

In all you do, always ensure that a strong antivirus is installed in your computer and also scan it always.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.