Geek's Advice

IIPS ransomware encrypts all files, marks them with new extension

IIPS ransomware is a highly destructive file-encrypting virus that belongs to the STOP/DJVU ransomware family. It is a notorious malware that encrypts every file it finds in any computer following infiltration and appends them with .iips extension respectively, such as a file that was initially known as 1.jpg before an infection automatically becomes 1.jpg.iips, and it goes on. It simultaneously drops a ransom note known as _readme.txt in every folder even while the attack is still ongoing. Contained in these notes are messages sent by those behind the attack, explaining the situation and need for the victim to contact them urgently in order to pay a certain fee as ransom so they would be able to receive IIPS decryption tool.

They would further claim that IIPS ransomware virus has succeeded in encrypting (to make unreadable) all files contained in the compromised computer. Therefore, it was necessary for them to comply by paying the ransom being demanded since that’s the only way they would be able to retrieve their files. To establish a channel of communication, the cybercriminals will equally include two email addresses namely: support@sysmail.ch and helprestoremanager@airmail.cc.

In addition to that, they will also notify the victim about conditions and terms of payment. For instance, they will state that payment must be made before 3 days/72 hours elapses if the victim desires to pay only 50% of the ransom fee. Therefore, instead of paying $980, they would now have to pay $490, but failing to do so within the ‘grace period’ means that only the maximum ransom fee would be acceptable.

It becomes more complicated if/when the victim contacts the cybercriminals via any of the emails. They will direct the victim to buy cryptocurrency worth of the ransom fee and transfer same to wallet address they will provide. They take such measures because any other medium of payment is fraught with danger since law enforcement agencies could trail such channels to get them arrested unlike cryptocurrency that offers anonymity. In their desperation to influence the victim to believe there files would be decrypted by them after making payment, they often request for parts of the encrypted files to be sent to them for test decryption but would be quick to warn that such excerpt must not contain any information that could be deemed as vital to the victim.

Regardless of how important the encrypted files may be to the victim or the pressure the cybercriminals put on them, our cybersecurity experts advise that ransom demands should not be honored. This position is also shared by the FBI in their guidelines about ransom payments. The reason for such strict stance is due to the following factors:

• Paying ransom does not guarantee recovery of encrypted files.
• The more money cybercriminals receive, the more emboldened they become in perpetrating such criminal acts since they would find it profitable.
• More funds at the disposal of cybercriminals would enable them to employ more rogue IT personnel thereby increasing their capacity to inflict more harm to a greater number of people.
• Paying ransom might be considered illegal by law in your country.

This virus is also capable of spreading other Trojans like AZORULT and VIDAR that are notorious for stealing sensitive information such as software account login details, cryptocurrency wallet’s ID/password, banking information, browsing history and computer-saved passwords etc. Once they have access to those aforementioned details, it gives them an opportunity to perpetrate more crimes that could include stealing and blackmails.

For those that are unfortunate to have fallen victim to any of the STOP/DJVU ransomware variants including the one under review, you’re hereby advised to remove IIPS ransomware virus from your PC ASAP. The recommended way to go about it is to boot your PC using the Safe Mode with Networking option before running any reliable antivirus on it. This method will ensure that the malware is completely removed from your system. If you’re not sure of any strong antivirus to use, then we strongly recommend INTEGO Antivirus because it has proven to be nearly 100% effective and efficient. You can also download RESTORO to repair and restore damaged Windows OS files.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Ransomware distribution methods frequently used by cybercriminals

Downloading malicious torrents is the most common way through STOP/DJVU ransomware variants, including IIPS virus are spread. Cybercriminals exploit some internet users’ penchant for visiting online torrents, by attaching virus to such pirated software copies. They would remain dormant/in hibernation mode until they become triggered by unsuspecting users who download them. There have been diverse reports of ransomware attack following the downloading of certain software contents gotten from online torrents. The most common pirated software copies used for spreading malware are listed below for awareness purposes:

• League of Legends;
• Corel Draw;
• Tenorshare 4ukey;
• AutoCad;
• Opera browser;
• Fifa 20;
• VMware Workstation;
• Cubase;
• Adobe Illustrator;
• Adobe Photoshop;
• Internet Download Manager;
• KMSPico (illegal Windows activation tool).

At this point, it has become clear that those visiting online torrents are taking unnecessary risk and should stop doing so right away. Cybercriminals are motivated by their greed to extort money from unsuspecting software content users. Therefore, instead of visiting online torrents platforms to obtain so-called “cracks”, key generators, or have access to paid game versions at no cost, you should source for them through the appropriate channels, even if you’re required to pay for them. At least, you won’t be at risk of losing vital files or sensitive information and neither would cybercriminals be able to extort you. Moreover, downloading copyrighted software contents illegally from online torrent platforms is considered a criminal offense and is punishable by law.

Another distribution method often used by cybercriminals is through malicious email attachments. In this case, cybercriminals would create ordinary looking emails to deceive their target victims into believing they were sent by loved ones, acquaintances or popular corporate brands. They will attach documents formatted on DOCX, XLS, PDF or similar ones that enable macro functions or JavaScript which can be used to download payload from external sources and trigger them on random computers.

It is worrisome to note that detecting which emails are real or malware-laden has become pretty difficult of late. This is because cybercriminals now go the extra mile to make them convincing. They now use names like DHL, eBay, FedEx, Amazon, UPS etc. while attaching files with names like Tracking Details, Invoice, and Order Summary etc. just to deceive their target victims. When you’re faced with such dilemma, it is best to apply common sense and ask yourself questions like: is the email expected? Is there any reason for it? Is the email address spoofed? If the answers you get aren’t convincing enough, then it should be a warning.

Lastly, becoming a victim of STOP/DJVU is not the end of the road or enough reason to throw caution to the wind and start seeking for help from suspicious sites offering dubious decryption services. Most of these sites are scam. They disguise as decryption service providers but their real intention is to spread other variants of ransomware disguised as fake decryptors. Only DiskTuna and Emsisoft have proven to a substantial extent of having the expertise to decrypt files. Downloading fake decryptors can cause double file encryption.

More details concerning the infection

This part discusses the technical aspects of ransomware attack and how it manipulates your computer, especially in the wake of IIPS ransomware attack. The first thing malware does after a successful invasion is to launch its algorithm is to download additional build.exe or build2.exe executables coupled with winupdate.exe (this is what displays fake Windows screen). Once it completes that task, it will make a connection with https[:]//api.2ip.ua/geo.json before sending the result to geo.json file. The malware then begins information gathering of every detail concerning the computer under attack and stores all geolocation related information, this will include; zip code, geolocation, time zone, latitude and longitude. Below is an image showing geo.json file.

After that, it will create another file for installed software list, hardware details and forwards them to information.txt.

By making use of the geolocation information, it will profile it against their list of encryption-exempted countries, listed as; Ukraine, Belarus, Russia, Syria, Armenia, Tajikistan, Kazachstan, Kyrgyzstan and Uzbekistan.

If by any chance it reads positive to any of the listed countries, it will abort any further attempts and reverse itself. However, if on the other hand it is negative, the malware will extract online encryption key from their database and will combine it with the victim’s ID before saving them in bowsakkdestx.txt file and to PersonalID.txt file. Examples of these files are shown in the image below.

In situations whereby the malware wasn’t able to extract any online encryption key (this happens sometimes), it will decide to use an offline key as alternative. The striking difference both forms of ID is that while online key is unique per victim, offline encryption key is uniform for all victims subject to offline encryption. The appearance of t1 characters after the personal ID is an indication that offline ID was used. The implication is that such victim can reasonably hope to decrypt .iips files going forward unlike online ID that is far more difficult to decrypt. More information about this is provided in this article.

At this stage, the ransomware will commence full data encryption process by scanning every folder and encrypting the files with Salsa20 before using RSA-2048 encryption key to lock it. While this is ongoing, the virus will mark each file with more extensions.

Shown in the screenshot below is _readme.txt ransom note the malware leaves behind following an infiltration.

The virus will now delete Volume Shadow Copies using the command prompt shown here:

^{vssadmin.exe Delete Shadows /All /Quiet}

More domains will be added to Windows HOSTS file to prevent access to them. When the victim tries to open any of the blacklisted sites, DNS_PROBE_FINISHED_NXDOMAIN error message might come up.

Remove IIPS Ransomware Virus and Decrypt Your Files

Victims of ransomware attack should remove IIPS ransomware virus ASAP. Once it is finished, the following tasks should be done.

• Report the incident to appropriate authorities in your country.
• Restore your lost data using any available backup means.
• Learn possible ways to repair STOP/DJVU-affected files.
• Change all passwords directly or remotely used on the computer.
• Consider downloading RESTORO (download link) to identify and repair virus damage on Windows operating system files.

In summary, consider using a security software recommended by our experts – INTEGO Antivirus unless you already have an antivirus that is just as capable when removing a malware. However, as we always advise, prevention is better than cure; therefore do not engage in cyber activities that could put your computer and privacy at risk.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.