Geek's Advice

IISA ransomware is a malicious file-encrypting virus

IISA ransomware is a new variant of malicious computer virus that belongs to a group of notorious malware generally known as STOP/DJVU ransomware. The virus operates by encrypting all files contained in any computer it infects and equally appends .iisa extension to each file name. E.g., an existing file known as 1.jpg gets renamed to 1.jpg.iisa and the same process is repeated with every other file. While this attack is still ongoing, the virus release _readme.txt ransom notes in all the folders. Contained in the _readme.txt message is a notification from the cybercriminals informing the victim about the cyberattack while also providing a contact address and medium through which the ransom should be paid in exchange for a IISA decryption tool.

The ransom note will notify the victim that IISA ransomware has successfully encrypted (i.e., made useless/unreadable) all their essential data contained in the computer, which includes documents and pictures, among other relevant data with the use of a strong encryption key. Therefore, they would not be able to have access to the files again unless they pay a certain amount of money as ransom and also within a specified period of time. Included in the message will be two email addresses; manager@mailtemp.ch and helprestoremanager@airmail.cc. for the victim to respond to should they need more information.

The terms of payment is often indicated as follows; if the victim responds within 72 hours, i.e., 3 days, they will be liable to a 50% discount. In other words, they would be required to pay $490 to have their data decrypted but once it exceeds 3 days, they would be mandated to the full ransom fee of $980. In addition, the victim can only pay the equivalent amount through cryptocurrency to a wallet address that would be made available by the cybercriminals. They always use this option because of the anonymity it provides, unlike other channels that could leave traceable footprints. To assure their victims that all encrypted files would be decrypted once they pay the stipulated ransom, they will request for a portion of the encrypted files to be forwarded to them for sample decryption.

Our team of cybersecurity experts always advises that victims should follow the FBI’s guidelines when dealing with cyber criminals and thus should not accede to any request for ransom. This conclusion was reached after considering several factors;

• There is no guarantee that you will recover your files, even after paying ransom
• When you pay ransom, you’re encouraging cybercriminals to continue in their criminal activities since it is profitable
• More funds at the disposal of cybercriminals will enable them to employ an increased number of software developers and also enhance other logistics
• By cooperating with cybercriminals and paying ransom to them, you will be liable to prosecution.
• Information stealing Trojans like AZORULT may also be dropped by the virus as a secondary attack, purposely to steal very important personal information like sensitive banking details, passwords, cryptocurrency wallets, and software account login details etc. This could lead to further serious challenges that may include blackmails or loss of money/other digital valuables.

Victims of this ransomware virus should endeavor to get rid of it from their computer as soon as they can once they confirm the malware attack. The only effective way to do this is by activating and scanning genuine and strong antivirus software while your computer is in Safe Mode with Networking. This setup will make it easier for the antivirus to scan through the entire system without inhibition and completely rid it of any trace of malware. If you have any antivirus you’re absolutely sure of its productiveness, then you can make use of it. Otherwise, you should remove IISA ransomware using software recommended by our team of experts — INTEGO Antivirus. Please carefully go through the tutorial we provided below to guide you accordingly. Additional step in improving your PC’s condition after a ransomware attack is downloading and scanning with INTEGO Antivirus, a software capable of repairing virus damage to Windows OS files.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Ransomware distribution techniques and how to prevent them

The most common way through which STOP/DJVU ransomware variants such as IISA virus are spread is by downloading of malicious torrents. They usually hibernate in pirated copies of software, “crack” or key generator from illegal sources. Individuals that like making use of torrent downloads should desist from doing so because they’re putting their computer system at serious risk of a ransomware attack. Most of these software copies found in torrent databases only serve as bait used by cybercriminals to get unsuspecting victims. Below is a list of popular software copies cybercriminals often make use:

• Corel Draw;
• Fifa 20;
• Tenorshare 4ukey;
• AutoCad;
• Opera browser;
• Adobe Photoshop;
• VMware Workstation;
• Cubase;
• Adobe Illustrator;
• League of Legends;
• Internet Download Manager;
• KMSPico (illegal Windows activation tool).

Like we pointed out earlier, trying to make use of torrent downloads online is a risk not worth taking. On the contrary, we advise that software users should rather make use of genuine software and also to subscribe through their official pages or affiliated partners as advertised by the developers. Always remember that whatever amount you pay to buy original software copies is little compared to what you will be asked to pay after becoming a victim of a ransomware attack. Additionally, you would be putting sensitive personal information at risk.

In addition to the mediums mentioned above, another way cybercriminals spread malicious malware is through email attachments. So, in order to deceive potential victims, they will create an email and make it appear like it was from a genuine source. The platforms they mostly use are DOCX, PDF, and XLS, simply because they allow JavaScript and other macro functions. The difficult part is that telling which email is genuine from those coming from cyber criminals can be a herculean task. For instance, the cybercriminals may decide to front as a friend or colleague, or even as a reputable company such as eBay, UPS or DHL. Using such decoy, they may give the attachment names like Invoice, Order Summary or Tracking Details etc. Sometimes, they may also spoof the email in order to conceal its source. Whenever you’re faced with such a dilemma, always apply common sense and act smartly by not opening such attachments if you think something is odd about them.

Victims should do themselves a world of good by staying away from rogue websites that claim to have the ability to decrypt ransomware-affected files since such tools are not readily available. At the moment, the only STOP/DJVU decryption and repair tools with proven efficacy is those being offered by Emsisoft and DiskTuna (you can check below for how to make use of the tool or in this complete file decryption/repair guide). Cybercriminals equally spread other types of ransomware like ZORAB through fake STOP/DJVU decryptors. Note that an already encrypted file can be doubly encrypted with the use of ZORAB and other similar ones.

More details about IISA ransomware

For any victim who may be wondering to what extent the IISA ransomware must have compromised his computer, this part would come in handy as it talks about the technical aspects of the virus. The first thing the virus does is to release a set of build.exe or build2.exe along with winupdate.exe (fake Windows update screen). Afterward, it will connect to https[:]//api.2ip.ua/geo.json and the next action will be to save the outcome to the geo.json file. At this point, the malware will pick all relevant details concerning your computer, and will include the geolocation, time zone, longitude and latitude, zip code as well as other details.

Please check the image below to have an idea of how the geo.json file appears.

Additionally, the virus extracts information about the compromised computer’s name, list of installed software and active processes, and hardware details. These pieces of information would be forwarded to its server for profiling. The virus saves collected data to information.txt file which is shown in the image below.

A number of nations, mostly from the former USSR and the Middle East are in the list of encryption-exempted countries, namely; the Russian Federation, Uzbekistan, Syria, Tajikistan, Kyrgyzstan, Armenia, Belarus and Kazachstan. Once the computer’s geolocation is profiled and it matches with any of the listed countries, it will immediately stop the encryption and reverse itself. However, if the geolocation does not match with any of them, the ransomware will move to the next stage by extracting an online key from their server and will combine it with the victim’s ID. This detail would be saved in the bowsakkdestx.txt file and also to the PersonalID.txt file. A good example of this is shown below.

However, if peradventure the malware fails to extract an online encryption ID, it would resort to an offline encryption ID. The striking difference is that offline encryption ID makes use of one uniform key for all victims, unlike online ID that creates a unique ID for each victim. When t1 characters appear at the end of the victim’s ID, it is an indication that the key used is offline. This outcome means you can possibly decrypt .iisa files in the future. More information on this is shown in this article.

It now commences full data encryption by scanning every folder and encrypting each file with Salsa20 before using the RSA encryption key to lock it. Meanwhile, it will also identify each file with the extensions appended to them.

In the image below is a sample of the _readme.txt ransom note that is dropped in each folder.

The next stage is where Volume Shadow Copies would be deleted by the Command Prompt task. An example is shown here: vssadmin.exe Delete Shadows /All /Quiet.

The virus proceeds to compile several domains, which would be added to the Windows HOSTS file and then mapped to a localhost IP. Once this is done, the victim would no longer have access to any of the blacklisted websites. DNS_PROBE_FINISHED_NXDOMAIN error may appear each time they are entered into the search bar. The cybercriminals make this move in order to prevent the victim from seeking help online.

Remove IISA Ransomware Virus and Recover Your Files

Individuals whose files were encrypted by this malware variant should get in touch with relevant local authorities and report the incident (you can follow the guideline outlined below). Meanwhile, it is very important that you must remove IISA ransomware virus from your computer ASAP. We always emphasize the use of a reliable antivirus because the antivirus you use could make or mar the entire process. That is why we recommend INTEGO Antivirus because it has proven over time to be efficient and reliable at all times.

Additional tool that we recommend using to identify and repair infected Windows OS files can be downloaded here: RESTORO. Scan it and see how it can help your computer after virus infection. You can also leverage the guide below on you start your computer in Safe Mode with Networking. Once you set it up, it becomes easier to remove the ransomware (using a genuine and strong antivirus) now that most functions are in dormant mode.

Now that you have successfully completed IISA virus removal, don’t forget the following steps as advised by our experts:

• Inform relevant local authorities about the cyberattack;
• Replace your lost data using a backup;
• Learn how to decrypt STOP/DJVU versions;
• Change all passwords immediately.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.