Geek's Advice

HHEO Ransomware Virus Emergence & Why You Should Stay Safe

HHEO ransomware is one of the latest computer virus versions distributed by the cybercriminal gang that’s responsible for STOP/DJVU ransomware attacks. Once the virus infects a computer system, it will commence encryption by whereby it renders all data contained in the computer unreadable. After encrypting every file, it would append .hheo extension to each of them as a form of identification. For example, random files already stored in the computer with names like 1.jpg and 2.jpeg would be transformed to 1.jpg.hheo and 2.jpeg.hheo respectively after the encryption. Victims should note that affected files will include documents, pictures, and videos. All these files could be affected at once makes this ransomware virus extremely disruptive and should be avoided at all costs.

This malware is believed to have been embedded in diverse cloned software contents and a significant number is already in circulation, especially in online torrent platforms and other distribution channels.

The aim of this computer threat is to demand ransoms

Nevertheless, while the malware attack is still going on, the cybercriminals behind it would also forward ransom messages known as _readme.txt. These messages would inform the victim about what has occurred and what they’re expected to do in compliance with them. They will claim that a very strong algorithm was used in the process, making it impossible for the victim to restore the encrypted file without their permission. However, they must pay a ransom fee before they forward the decryption tools.

At this point, the victim would have come to terms with the loss of vital documents and may be desperately seeking for how to recover them. Based on experience, the cybercriminals already know the victim would be anxiously seeking for a way out. So, they would send across two email addresses: support@bestyourmail.ch and supportsys@airmail.cc and would it appear like help could come by merely writing to them.

However, if the victim takes the bait and sends them an email using either of the two email addresses, they would respond by stating that ransom fee must be paid before they could send across a decryption tool. Initially, they would put the ransom fee at $980 and add that only half of it would be accepted provided the victim can pay ASAP and not exceed 72 hours after being informed to do so. They would also warn that once it exceeds 3 days without receiving the payment, they would nullify the price slash and insist on the full ransom fee.

As if all that isn’t enough challenge already, they would also insist that ransom payment can only be made via cryptocurrency transfer. For obvious reasons, they prohibit the use of money transfer, direct bank payment, or various other conventional methods of payment. They consider the use of crypto as a safe haven since their physical address or personal identities remain hidden.

To assure the victim that they possess the skill to retrieve the encrypted files, they may suggest that victim should forward excerpts of it to them for test decryption. However, they would also add a caveat that returning the decrypted copy would be at their discretion, depending on whether they consider the content as useful to the victim or not. What they’re trying to do here is just to give themselves room for maneuver since they have no intention of returning the excerpts.

However, there is a general consensus that victims shouldn’t pay ransom to cybercriminals no matter the pressure they put on their victims. In actual sense, victims are advised not to communicate with them in the first place. This recommendation is supported by the FBI and other reputable cyber security organizations. Stated below are some of the points they considered before arriving at their conclusion:

• It doesn’t make sense to pay huge sums of money to cybercriminals since there is no guarantee they will restore your encrypted files.
• Based on existing laws, it is an offense to pay ransom to cybercriminals.
• You will be making yourself vulnerable to future attacks by cybercriminals because they often seek for ways to extort more money from paying victims.
• When you pay ransom to cybercriminals, your funds will help them to expand and cause more problems to computer users.

More about this specific computer virus

Although the group of cybercriminals behind STOP/DJVU ransomware virus operates globally, there are selected countries they designated as “protected from cyber-attack”. They are listed as follows: Russia, Belarus, Uzbekistan, Kazachstan, Ukraine, Syria, Tajikistan, Armenia and Kyrgyzstan. It is not clearly understood why they decided to exempt these countries. However, if HHEO ransomware virus infects a computer system, the initial action it will take is to unravel its geo-location. This will be done by connecting to https[:]//api.2ip.ua/geo.json. The next action would be to forward the result to geo.json file. This is where vital pieces of information such as country, city, IP address, and zip code, as well as longitude and latitude. These steps would help it conclude whether the computer’s data should be encrypted or not, depending on its geo-location.

Granted that more emphasis is being directed at the problems that could emanate from HHEO ransomware, yet it is by no means the only risk factor. Cybercriminals behind the STOP/DJVU ransomware virus often embed other Trojans alongside the primary malware. Generally known as Remote Access Trojans or RAT’s, they can covertly infiltrate a computer and be used in extracting other important pieces of information like passwords, banking details, cryptocurrency wallets, software login credentials, and browsing history among others. Such covert operations and extraction of sensitive are what makes the RAT’s dangerous and thus should be guarded against.

The need to stay safe from both the primary and secondary ransomware virus being distributed by STOP/DJVU ransomware is why you’re advised to get rid of them from your computer whenever they are detected. Although, there are a couple of methods you can use to get rid of them, we will only recommend the most effective method, which is the use of Safe Mode with Networking Option.

The most effective way to remove HHEO virus is to set up the compromised computer system in Safe Mode with Networking (It is one of the booting options you will be asked to select from whenever you login to your computer) before activating and scanning your antivirus. Please note that not all antivirus are genuine or even effective. Therefore you should be careful about the brand you chose.

You should consider whether it is necessary to download RESTORO and use it to repair some of the Windows OS files that became damaged during the cyber-attack.

Ransomware Summary

REPAIR VIRUS DAMAGE

Files encrypted by this ransomware will have new extensions appended to them and the victim may also notice a ransom note file saved in the containing folder as shown in the screenshot below.

How Computer Users Can Effectively Prevent STOP/DJVU Ransomware Virus

In order to keep your computer safe at all times, you must avoid certain risk factors such as the use of peer-to-peer software sharing, going to online torrent platforms, or indiscriminate opening of emails, especially when you did not recognize its source. Also, be on the lookout for emails with spoofed originating addresses or emails/attachments with a title that doesn’t seem to make sense to you.

Since we began to monitor the activities of cybercriminals, we realized that more often than not, they prefer cloning software copies that are in high demand and would use diverse illegal platforms like online torrents to catch unsuspecting computer users. Shown in the list below are some of the popular software content usually pirated and embedded with malware.

• Adobe Premiere Pro;
• Fifa 20;
• Adobe Illustrator;
• Adobe Photoshop;
• Corel Draw;
• VMware Workstation;
• Cubase;
• AutoCad;
• Tenorshare 4ukey;
• League of Legends;
• Internet Download Manager.

When you attempt to download some of these software contents, using the appropriate channels, you will realize that they’re mostly affordable to those that need it. Therefore, there is absolutely no need to go to dubious platforms because you want to obtain them at little or no cost. Also, remember that using the appropriate media endorsed by the original content producer helps the IT industry to grow. Likewise, your computer won’t be at risk of virus infection. Whatever amount requested by the producers, rest assured that it can never be comparable to the outrageous ransom fees usually demanded by cybercriminals.

Cybercriminals also use files like PDF, XLS and DOCX, among others, because of their macro function abilities that allow secondary attachments, including malware, to be embedded in them. Cybercriminals use the functionality of these files and their capability to store scripts to make them malicious.

Victims of STOP/DJVU ransomware virus should also be wary of certain websites that often claim to have decryption tools. Most of them are fraudulent and their mission is to further scam you. However, only DiskTuna and Emsisoft have proven effective as decryption tools that can be trusted.

How to Get Rid Of HHEO Ransomware Virus & Restore Files

Before we conclude this article, there is need to reemphasize that Safe Mode with Networking is the option you need to select when login in to the infected computer. It is also vital to only use antivirus software with a proven track record of excellence. Ensure you remove HHEO ransomware virus using the full system scan option.

After completing the HHEO ransomware removal procedure, the following actions should be taken as well:

• Let the local police know about the incident.
• Restore lost files using any available backup.
• Research on possible ways to restore files damaged by STOP/DJVU ransomware.
• Passwords used in the infected computer need to be changed.
• Consider downloading RESTORO for a free system scan to see if some virus-affected files could be repaired. This functionality is available in full version of the software.

OUR GEEKS RECOMMEND

Our team recommends removing malware using a professional antivirus software and then using the following tool to repair virus damage to Windows system files:

REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.