Geek's Advice

IRJG ransomware encrypts files on you computer, then tries to extort you

IRJG ransomware is a recognised variant from STOP/DJVU file-encrypting computer virus family. The virus takes advantage of Salsa20 algorithm to encrypt personal files on victim’s computer and make them inaccessible. Once encrypted, the malicious program will attach .irjg file extension to all the files respectively to make them distinguishable. Take for instance, a file originally saved as 1.jpg becomes 1.jpg.irjg after being struck by the cyber-attack. Afterwards, the virus equally drops a note called _readme.txt (a ransom demand from the cybercriminals who initiated the malware attack) in all folders, including the desktop. The note claims that paying a ransom is the only way to get a IRJG decryption tool and key. The cybercriminals also give the following conditions regarding IRJG decryption tool price: 

• Decryption costs $490 when you contact them within 72 hours;
• Decryption costs $980 when you contact them after 72 hours;
• The payment can only be made through cryptocurrency such as Bitcoin (this is apparently to protect their identity).

A new contact email address (supporthelp@airmail.cc) will be provided and such is not available in previous STOP/DJVU versions as well as the regular one i.e. manager@mailtemp.ch. 

Apparently, IRJG ransomware virus is basically aimed at extorting computer users by aggressively taking their files hostage with intent to earn ransom. The algorithm of this ransomware virus is programmed to encrypt just the initial 150 KB of every file (a factor that makes the process fast) yet powerful enough to shut out the genuine owner from having access to their file. The algorithm pattern used in the encryption process is reputed to be advanced and works by blocking access to information at both ends so that only those that have the decryption key would be able to view it. The helpless victims would be forced to pay for the key as well as the decryption software at a price that would be determined by the cybercriminals.

However, for files that were hitherto encrypted, there are ways one can take that will help to restore the files, or at the very least restore a part of it. The first option will be to make use of data backup i.e. if one was created ab initio. Please note that it is mandatory to remove the ransomware from the computer before trying this.  You can equally leverage the guide provided below and follow the steps that will lead you to successfully decrypt or repair the files as the case may be. For file repair, you can make use of Media Repair by DiskTuna to restore particular file formats. Here is the link to it how to do it how to do it here.

They also emphasize that complete decryption costs $980 but if the victim is fast enough to comply within 72 hours, they will be liable to a 50% discount thus effectively bringing the cost $490. If/when the victim contacts them through the email they provided, they will respond by forwarding details about how the victim could buy cryptocurrency that will correspond to the amount they are supposed to pay and of course the wallet address they should send it to. The obvious reason why they avoid bank transactions is simply to avoid being traced and arrested.

High level cybersecurity experts from Geek strongly advices against paying ransom to cybercriminals. Other top law enforcement agencies like FBI also belong to this school of thought. Below are some of the basic reasons why you should refrain from paying ransom to cybercriminals: 

• There is no guarantee you will either partially or completely recover all your data. Also, there is a high chance that the cybercriminals may disappear into thin air the moment they receive the ransom.
• Paying ransom to cybercriminals encourages them to continue attacking other victims and equally lures others to join the criminal activity even when they have limited technical knowledge. Reliable statistics shows that cybercriminals extort millions of US Dollars from victims annually. So, in essence, if people refrain from paying such ransom, those behind it would have no incentive to continue.
• Other STOP/DJVU virus variants like IRJG are known to release additional virus on the system, a good example is AZORULTTrojan. This malware could extract sensitive data from the system which the cybercriminals may exploit to do further damage.

REMOVE MALWARE & REPAIR VIRUS DAMAGE

How this ransomware operates on victim’s computer

Basically, IRJG ransomware virus is able to invade a computer system when a user unwittingly downloads a malicious torrent file or more specifically, a software crack. It will then escalate by opening many build.exe executables such as build2.exe and build3.exe as it prepares for full scale takeover.

In addition to that, the ransomware extracts certain data from the system such as computer name, user name, OS version, hardware details, keyboard language, processor and software etc and stores them in information.txt file. It also connects to “https[:]//api.2ip.ua/geo.json” which enables it to extract vital information such as IP address, country code, city, longitude, latitude, zip code and also the time zone where the victim is located. The virus traces the country code with others from a profiled list and once it corresponds, they will truncate its functions. 

Next will be to figure out if there is internet connection, and if there is, it connects to the Command and Control server and extracts unique online encryption key that would be reserved for the victim in bowsakkdestx.txt file within the computer. Furthermore, it will allocate a peculiar ID to the victim and equally saves it in the bowsakkdestx.txt as well as PersonalID.txt file. Peradventure the virus fails to access its C&C server; it will make use of a hardcoded encryption key that works offline. The easiest way to decode if an offline encryption key was used is to look out for the t1 characters which will appear after the victim’s personal ID.

The IRJG ransomware then saves the victim’s ID string as well as public encryption key within the computer for future use. 

Now it has formulated the encryption key, it will begin the data encryption stage. Already, it has been programmed to target specific file extensions while ignoring some others in order to ensure the operating system continues to function. At this point, the ransomware blocks access to files, configures them with more extensions and then drops ransom notes on any directory the victim visits.  Simultaneously, the virus will display winupdate.exe, a fake prompt disguised as genuine Windows update, aimed at making the victim to assume that the sudden slowdown was as a result of the system updates. 

Such malicious programs enable the Volume Shadow Copies to be evacuated from the computer through a process known as Command Line Task:

^{vssadmin.exe Delete Shadows /All /Quiet}

The reason is to make it impossible for the victim to use System Restore points to salvage some of the data.

Certain STOP/DJVU versions have the ability to modify Windows HOSTS database by inputting several domains to block the victim. The virus then aggregates them to a localhost IP which would lead to a DNS problem. As a result, whenever the victim makes attempt to access any of the blocked domains, whether directly or through search engine results, what they will see is a DNS PROBE FINISHED NXDOMAIN error message. It has been observed that the malware equally blocks other cybersecurity as well as the system’s help related pages such as microsoft.com among others. After considering what their motive could be, we arrived at the conclusion that the cybercriminals are intent on stopping their victims from getting help online or finding beneficial recommendations that will aid them in their approach to responding or reporting the situation.     

The last but probably the worst thing the IRJG ransomware does is to drop the AZORULT, a notorious information extractor that will not only steal vital information from your system but also grants the cybercriminals continued remote access to your system, thus enabling them to engage in the following activities:    

• Upload certain types of computer malware and also run them
• View or delete information on the victim’s computer
• Steal important details such as cryptocurrency wallets/passwords and carting away its contents
• Obtain login details of confidential files such as Telegram and Steam among others, and may either use them to exploit the victim or send them to other criminals

To avoid colossal damage or losses, individuals are advised to immediately take steps and get rid of such malicious viruses as soon as they can. To effectively remove IRJG ransomware from your computer, we strongly advise that professional and reliable security software should be used. This is to ensure that such viruses are not only completely removed but to also prevent such cyber-attacks from reoccurring in the future. Based on this, we recommend the use of INTEGO Antivirus, a VB100 certified software. Similarly, you can also download RESTORO and use it repair any damage caused by virus on your operating system files.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Distribution of ransomware-type viruses

In order to be proactive and prevent any form of ransomware attacks from occurring, it is crucial to understand the processes and how the cybercriminals operate. The most common methods they apply include exploit kits, malicious emails with links and attachments, malicious torrents downloads, as well as web attacks.

The most common way through which they spread STOP/DJVU malwares like IRJG ransomware virus is when individuals try to access malicious torrent downloads. An overwhelming majority of victims that reached out to us all stated that they downloaded it alongside software cracks that were supposed to work on certain commonly used softwares as listed below: 

• Adobe Photoshop;
• Corel Draw;
• Tenorshare 4ukey;
• League of Legends;
• Cubase;
• Adobe Illustrator;
• Windows activation tools such as KMSPico.

Oftentimes, those that fall victim to cybercriminals are individuals that try to obtain paid software versions at no cost, by making use of peer-to-peer file sharing formats. Unfortunately for them, such programs do not have the capacity to effectively scan and detect malwares. Worse still, this segment of software users usually ignore warnings from their cybersecurity during such downloads. Also, many users assume that any cracked file that is downloaded from the internet would always trigger a red flag regardless of their risk level. Even though this could be true sometimes, but it is still dangerous to ignore such alerts. On the other hand, there are still chances that your system could become infected during such downloads without triggering any alert. Such occurrence is commonplace when one is using Trojan, cryptocurrency mining software, or any other ransomware that has idle mode option. 

We advise individuals that desire to make use of the premium software version to visit the official website page of the developer and obtain a genuine copy from them. Aside the risks inherent in bypassing legitimate process, it is equally wrong to encourage greedy criminals that feed off other people’s efforts. Also bear in mind that whatever you pay for a genuine software is insignificant relative to what it will cost you when you eventually become a victim to cybercriminals.  

Cybercriminals generally send out malicious email messages with attachments and links to lots of potential victims. They extract random email addresses from diverse databases including those that leak in the dark web. Sometimes, they could appear as if they emanated from reputable companies, friends, family or acquaintances. However, they often nudge the potential victim to go through the documents and attachments, and reply ASAP. Also note that such attachments are usually given names that make them appear authentic such as invoice, parcel tracking details, order summary, payment details, waybills etc. They can even go as far as to spoof the sender’s email address to deceive their target victims.  

Cybercriminals have become more sophisticated in recent times, and it is now even more difficult to decipher scam emails from genuine ones. However, we strongly advise individuals to refrain from opening such attachments or links if they weren’t expecting them in the first place. Don’t allow your curiosity to get you into trouble. Furthermore, if you have second thoughts that something is out of place with the email, like a strange style of writing, grammatical errors, poor looking/unprofessional logos, weird/ridiculous opening salutation, or if it tries to influence you to click on any attachments or links. 

Before we wrap it up, the final malware we would like to bring to your notice is the fake STOP/DJVU decryption tools. It is really important for you to know about this notorious virus that disguises as a decryption tool. The good thing is that these rogue tools are already well known, at least popular cybersecurity news platforms, antivirus producers’ reports and similar legitimate sites often discuss about them and also create awareness on why they should be avoided. So we advise you stay away from any illegitimate website or platform that provide such downloadable links. It is interesting to note that cybersecurity experts have already warned that ZORAB ransomware agents are now spreading their own virus through fake STOP/DJVU decryption tools they make available to the unsuspecting public. Any attempt to use such tool could result in further encryption of your files, thereby jeopardising your chances of recovering them.

Remove IRJG Ransomware Virus and Decrypt Your Files

If unfortunately you fall victim to ransomware attack, the best thing you should do is to immediately eliminate it from your computer ASAP. Our in-house experts recommend the use of INTEGO Antivirus —a very reliable antivirus software that equally has real-time protection. Below is the easy DIY guide that would assist you in a step-by-step way, through Safe Mode with Networking, to safely remove IRJG ransomware virus. Also, you can download RESTORO and use it to repair any damage the virus may have caused on your files/operating system. 

Once you complete the process of removing the IRJG ransomware virus, kindly follow the tips listed below. It is a guide that would help you to stay on course and also avoid any challenges going forward:

• Brief the local authorities about the situation. You can leverage some of the references contained in this guide while reporting the cybercrime.
• Use any backup source to restore your files as much as you can.
• Here is a link that will help you to decrypt or repair files affected by STOP/DJVU versions.
• We advise that you change your passwords to avoid any future data breach.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.