Geek's Advice

JJTT ransomware lock all files on a computer, demands ransom from the user

JJTT ransomware is a malicious computer virus originating from the STOP/DJVU ransomware family. It is intended to encrypt all files on victim’s computer and mark them with additional .jjtt extension. To illustrate, a file originally called 1.jpg becomes 1.jpg.jjtt, document.docx becomes document.docx.jjtt and so on. After compromising data in a folder, the virus drops _readme.txt note in it. This note contains a message from the ransomware operators, who suggest that purchasing JJTT decryption tool is the only way to recover encrypted data. In other words, virus’ developers seek to extort the computer user while all personal data is being held hostage.

The ransom note suggests that all of victim’s files have been encrypted with strongest algorithms and cannot be recovered without the cybercriminals’ help. According to them, this “help” costs between $490-$980 in Bitcoin, depending how quickly the victim reaches out to the attackers via provided emails – support@sysmail.ch and helprestoremanager@airmail.cc. As stated in the note, the lower price point applies if the victim writes to the criminals within 72 hours. Otherwise, the ransom asked will rise to $980. As usual, the attackers want to receive the payment in cryptocurrency since this helps them to avoid being tracked down.

Additionally, the note suggests testing the proposed JJTT ransomware decryption solution by sending one encrypted file to the attackers via email. The crooks suggest they would reply with a decrypted version of the file only to prove that it is “worth” paying the ransom. However, cybersecurity experts worldwide agree that paying the ransom is not recommended. The same is stated in official FBI’s guidelines regarding ransomware attacks.

The reasons why you shouldn’t pay the ransom are simple. First of all, it never guarantees that you will recover your files. The decryption tool might be faulty or simply a deception; moreover, it might not work due to your modifications to files. Secondly, paying the ransom to cybercriminals encourages them to continue their activities, expand their team and this is simply wrongful approach after being hit by file-encrypting malware.

Finally, you should be aware of the fact that STOP/DJVU ransomware variants like this one tend to compromise the system with information-stealing Trojans such as VIDAR or AZORULT. These malware pieces are capable of collecting login credentials, banking information, cookies, browsing history and more details that can lead to further blackmail.

If you have been hit by this notorious malware, we strongly recommend that you remove JJTT ransomware virus without a delay. The best way to eradicate computer threats is by running an antivirus solution while the computer is booted in Safe Mode with Networking. You can find detailed instructions on how to secure your computer down below. In case you haven’t decided on which antivirus to use, consider trying one recommended by our team of experts – INTEGO Antivirus. Additionally, you may want to go ahead and download RESTORO, a tool that can identify and repair virus damage to Windows OS files.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

How ransomware-type computer viruses are distributed

The most common distribution method associated with all STOP/DJVU ransomware variants including JJTT virus is malicious and deceptive online downloads. Cybercriminals were noticed to prey on victims who seek for pirated software versions online. The attackers upload fake software cracks, keygens and other tools that simply hide the ransomware payload in them for victims to download themselves. After opening the attached executable file, all victim’s files get compromised instantly. So far, victims have reported downloading the malware along software cracks of these popular programs:

• Adobe Photoshop;
• KMSPico (illegal Windows activation tool);
• Tenorshare 4ukey;
• VMware Workstation;
• AutoCad;
• Opera browser;
• Corel Draw;
• Cubase;
• Adobe Illustrator;
• League of Legends;
• Internet Download Manager;
• Fifa 20;
• Various AV software.

Please do not download software from unconfirmed sources online (websites offering free and 100% working full software versions, torrent listings, etc.) as this can lead to severe computer infection and theft of your personal information. If you have a habit of doing it, you should remember that it infringes legitimate software copyrights and also puts your privacy at risk. Moreover, a legitimate software license fees are much lower than hefty ransom amounts demanded by cybercriminals. When in need of a specific software, please visit its official developer’s website or its confirmed partner’s website instead.

Another popular way to distribute malware is by injecting a malicious code into documents (PDF, DOCX, XLS and other formats) and sending such files as email attachments to potential targets. The attackers go extreme lengths to deceive computer users, often posing as legitimate companies, work colleagues or bosses and suggesting to immediately open attached contents and reply to the sender. They might even make use of email spoofing techniques to obfuscate the real sender’s email address and display a different one. We recommend that you avoid opening emails you did not await for, and also look out for red flags in the email such as unfamiliar greeting line, sense of urgency, typo mistakes, low-quality and weirdly aligned logos.

Finally, victims of STOP/DJVU ransomware should be cautious when it comes to looking for data recovery solutions online. At the moment of writing this, only Emsisoft and DiskTuna have confirmed solutions to decrypting/repairing files locked by this ransomware strain. However, the functionality of these tools is still limited and depends on several conditions. If you try to find other miracle decryption tools online, you might get infected with additional ransomware such as ZORAB. Its distributors have used the tactic of uploading fake STOP/DJVU decryptors online only to double-encrypt victim’s files.

How this ransomware operates on victim’s computer

In this article section, we will overlook the modus operandi of JJTT ransomware virus. It begins its attack by launching an executable named with 4 random characters, for instance, 5GB5.exe or 14H7.exe. This process then downloads two additional executables named build.exe and build2.exe. In some cases, a helper program under the name of winupdate.exe is also launched to display a fake Windows update prompt for the victim.

The virus then begins collecting information about the breached computer. The way this ransomware works is that it targets computers in specific countries only rather than infecting computers worldwide. It appears that the ransomware is designed not to encrypt files on a computer if it is located in one of the following Commonwealth of Independent Sates (CIS): Armenia, Azerbaijan, Belarus, Kazakhstan, Kyrgyzstan, Moldova, Russia, Turkmenistan, Tajikistan, Uzbekistan and Ukraine. To find out computer’s location, the virus connects to https[:]//api.2ip.ua/geo.json and saves the response from this URL to geo.json file. You can see two typical examples of such file below; it contains details such as country code, name, region, timezone, zip code, city, longitude, latitude and so on.

Next, the ransomware creates another text file called information.txt. This file comprises computer’s hardware information, installed software list and active processes. The virus then also takes a screenshot of computer’s desktop and then sends these two files to the cybercriminals’ Command&Control server. You can see a screenshot of this file below.

Next, the ransomware tries to obtain a uniquely generated victim’s encryption key along with personal ID from its Command&Control server. If it succeeds to do so, the victim’s files will be modified with so-called online encryption. If the virus fails to establish the connection with its server, it falls back to so-called offline encryption mode. The difference between these two is that for all victims of offline encryption, the same decryption key can be used to recover all files; in other words, there are slight chances to decrypt .jjtt files in the future as explained in this guide. For online encryption, each victim needs a unique decryption key that matches with the unique encryption key used.

The virus saves the encryption key and victim’s ID into the bowsakkdestx.txt file and also saves the ID into PersonalID.txt file. You can check whether you were affected by online or offline key by inspecting C:\SystemID\PersonalID.txt file. If the string saved there ends in t1, it indicates offline key encryption. You can see an example of both files down below.

The ransomware then begins encrypting all data stored on the computer. It uses Salsa20 algorithm for initial encryption and then secures it with private RSA-2048 key. During this process, each file gets appended with .jjtt file extension. You can see how a virus-affected data folder looks like in the screenshot attached below.

The virus also drops a ransom note named as _readme.txt in several computer folders. Contents of it are showcased below.

Next, the ransomware takes care of Volume Shadow Copies. The virus removes them from the computer using the following Command Prompt task:

^{ssadmin.exe Delete Shadows /All /Quiet}

Finally, the threat modifies Windows HOSTS file. It uploads a list of websites publishing information about computer security, ransomware incident response and related data. The domains of these websites are mapped to victim’s localhost IP, thus causing DNS resolution problem. The computer user can no longer access these websites. Errors equivalent to DNS_PROBE_FINISHED_NXDOMAIN error may appear in web browser when trying to access one of the blocked sites.

Remove JJTT Ransomware Virus and Decrypt Your Files

Victims who had their files encrypted by this notorious malware should rush to remove JJTT ransomware virus and related threats from their computers as soon as possible. This is needed to eliminate virus’ remains and information-stealing Trojans installed. For this, we recommend using the guide provided below to boot your PC in Safe Mode with Networking. From there, run your antivirus software. If you aren’t sure which AV solution to use, consider using a robust and well-reviewed software recommended by our team – INTEGO Antivirus. As an extra step, we recommend you to download RESTORO, a tool that has been proved effective when it comes to repairing virus-damaged Windows OS files.

If you have completed JJTT ransomware removal, please consider reading the following recommendations:

• Inform your local law enforcement agency about the ransomware attack you just experienced.
• Use data backups to restore your files fully or partially.
• Learn possible ways variants of STOP/DJVU encrypted files could be decrypted.
• Change all passwords that were used on the compromised computer.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.