Geek's Advice

KKIA ransomware sneakily encrypts your files

KKIA ransomware is a newly emerged computer virus that maliciously encrypts files contained in any computer it infects. It belongs to the notorious STOP/DJVU ransomware family and after encrypting files, it will append .kkia extension to each file name. For instance, a file that was formerly known as 1.jpg will automatically become 1.jpg.kkia after an attack. While the attack is still ongoing, ransomware notes known as _readme.txt will equally be dropped in all the folders. Contained in these _readme.txt ransom notes are pieces of information notifying the victim about the development and why they would have to pay ransom in order to receive KKIA decryption tool.

The cybercriminals will emphasize that KKIA ransomware virus was able to encrypt all files contained in the infected computer, including pictures, documents and various data that may be of critical importance to the victim. Also, by virtue of the very strong and unique key used in the process, the victim would have no way out except to pay certain fees as ransom for them to decrypt the files. To that effect, two email addresses (support@sysmail.ch and supportsys@airmail.cc) will also be provided to facilitate further discussion between both parties.

Decryption service prices will also be included in the ransom note as well as conditions attached with the payment. The cybercriminals will inform the victim that paying ASAP would enable them to pay only 50%. In other words, if they could pay within 72 hours of being notified, the ransom fee would be brought down to $490 but failure to meet up within that timeframe would mean paying the full ransom fee of $980.

If the victim decides to contact them through any of the emails they dropped in the ransom note, they will state that payment can only be made with cryptocurrency whereby the victim will buy its equivalence and transfer same to a wallet address that would be provided by them. The apparent reason why only this method of payment is acceptable to them is to cover their tracks and remain untraceable. To assure the victim of their expertise, they may ask the victim to send parts of the encrypted file to them for test decryption, but will also add that such parts must not contain any information they could perceive as important.

Nevertheless, our cybersecurity experts recommend that victims should follow FBI’s guidelines in matters relating to ransom demand/payment, and it clearly warns that ransom should not be paid. There are several reasons why ransom payment is strongly discouraged but the major ones are listed below:

• Paying ransom does not guarantee you will get your encrypted files back to normal.
• When you pay ransom, you’re making ransomware attack profitable for them which would only perpetuate the circle.
• More funds at their disposal will enable them to expand their criminal activities.

Moreover, the virus is known for dropping other Trojans (AZORULT, VIDAR etc.) that could discreetly steal secretly kept information such as banking details, software login credentials, cryptocurrency wallets, passwords etc. from the compromised computer. Such loss of sensitive information to cybercriminals could lead to further problems like blackmails and theft among others.

Victims of this STOP/DJVU ransomware version are advised to remove KKIA ransomware virus from their infected computer as quickly as possible. The most effective way to do so is set up the computer in Safe Mode with Networking booting process before applying any strong and up-to-date antivirus on it. The importance of using only genuine antivirus software can never be overemphasized because it could make or mar the entire process. Therefore, we recommend the use of INTEGO Antivirus because it has been tested and trusted. You should also consider downloading RESTORO which you can use to repair damages on your Windows OS files.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Ransomware distribution techniques in detail: avoid getting infected

The most typical ransomware proliferation method used by digital criminals behind STOP/DJVU including the likes of KKIA virus is through malicious online torrents whereby they would upload pirated software copies embedded with malware to such platforms. Some of them include the so-called “cracks” and key generators, and when unsuspecting users download them to their PC, they end up infecting them with virus. Over the years, victims of ransomware have complained about such attacks after they downloaded certain pirated software contents from various online torrent libraries as listed below:

• Adobe Photoshop;
• Adobe Illustrator;
• AutoCad;
• Cubase;
• Corel Draw;
• Fifa 20;
• VMware Workstation;
• Tenorshare 4ukey;
• Opera browser;
• League of Legends;
• Internet Download Manager;
• KMSPico (illegal Windows activation tool).

For those that usually go through online torrents platforms looking for software contents to download illegally, it would be in best interest to desist from such activities. Such places are a haven for cybercriminals looking for unsuspecting computer users to prey on. Those pirated software copies embedded with malware are used as a bait to catch their victims unawares. Also remember that such illegal downloads are considered acts of copyright infringement and is punishable by law.

Instead of exposing yourself to all these, we suggest that legitimate and genuine software developers should be encouraged by obtaining their works through the right channels as endorsed by them. Whatever fee they may request for their products is relatively small and can never be compared to the outrageous ransom fee demanded by cybercriminals. Another advantage is that you won’t be at risk of losing your important and sensitive files.

Another ransomware distribution method used by cybercriminals is through malicious email attachments. In this option, they would compose extremely believable messages that would be accompanied with custom-made attachments crafted using platforms like XLS, PDF and DOCX. These platforms are their preferred choice because they allow JavaScript and Macro Functions, both of which can be used in conveying payload from external sources and also releasing them on other computers.

The main challenge is how to differentiate between real emails and those sent by online crooks. This situation arose because they’ve mastered the act of deception. They may decide to impersonate as someone known to you or just any random but popular company brand such as eBay, FedEx, Amazon, UPS etc. and would also name the attachments with enticing captions like Invoice, Order Summary or Tracking Details. Alternatively, they may also leverage email spoofing methods to obfuscate the actual criminal’s email address. Whatever method they may try to use, you should always be on guard when opening emails, if such an email isn’t expected or intelligible with you, then it should be considered a red flag and ought not to be opened.

Finally, STOP/DJVU ransomware victims are advised to shun certain suspicious websites that often advertise about decryption solutions because such hardly exist. At the moment only DiskTuna and Emsisoft have proven capabilities of repairing files affected by STOP/DJVU ransomware virus. You can follow this link for an explanation about them.

More information about the virus

This section deals with the technical aspect of KKIA ransomware and how it affects the computer. Firstly, the malware will set up build.exe or build2.exe as well as winupdate.exe the prompt that displays fake update screen on Windows. Once it is done with that, it will connect to https[:]//api.2ip.ua/geo.json and also save the outcome in geo.json file. This file contains every relevant detail concerning the computer geolocation, such as: time zone, country, city, zip code, longitude and latitude, and others. Examples of the geo.json file are shown in the screenshot below.

The virus also drops information.txt file which contains computer’s hardware specifics, active processes and installed programs’ names.

At this stage, the malware will profile the computer’s geolocation against a list of countries they designated as encryption-protected and they include: Russia, Syria, Armenia, Ukraine, Tajikistan, Kazachstan, Kyrgyzstan, Uzbekistan and Belarus. If it detects that the computer under attack is located in any of the above countries, the ransomware will immediately halt any further action.

However, if on the other hand it reads negative, the ransomware will now fetch online encryption key from their server and would merge it with the victim’s ID and would save them in the bowsakkdestx.txt file and also the ID separately to the PersonalID.txt file. Examples of these files are shown below.

Peradventure it fails to extract any online encryption key from their server; it will resort to the use of hardcoded offline key as an alternative. The major difference both keys is that online key is specific to each victim while offline key is the same for all victims of the same variant. The presence of t1 characters suffixed at the end of the victim’s ID is an indication that offline key was used and it increases the possibility of decrypting .kkia files someday. More information about it is provided below.

The ransomware will at this point commence data encryption by scanning every folder and encrypting each file with Salsa20 algorithm. Afterwards, it will lock the encryption key using RSA-2048 code. Each file will be marked with additional extension. You can see how an affected data folder appears down below.

Here is an image of _readme.txt ransom note that is usually dropped in all the folders.

The malware will blacklist some specific domains by adding them to the Windows HOSTS file and any attempt by the victim to browse such domains will only bring up DNS_PROBE_FINISHED_NXDOMAIN error message. The aim of doing this is to preempt any attempt by the victim to seek help online.

Remove KKIA Ransomware Virus and Restore Your Files

The first thing that should be done by victims whose computers were infected by this virus is to remove the ransomware as quickly as possible. To do this effectively, you should set up the compromised computer in Safe Mode with Networking as stated earlier and also apply RESTORO or any similar one. Also download RESTORO for purposes of repairing damages on Windows system files. Please refer to appropriate section above for more details on this.

Now that you have removed KKIA ransomware, it is time to do the following:

• Let local law enforcement agencies know about the ransomware attack you’ve experienced.
• Restore lost data using any available backup device.
• Change all login credentials that were used on the infected computer.
• Read more about possible data repair/decryption options available for files affected by STOP/DJVU versions.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.