Geek's Advice

LLEE ransomware was created with intention to extort computer users

LLEE ransomware is recognized as a computer virus that encrypts all files contained in the compromised host. It is a newly discovered variant of STOP/DJVU ransomware strain, a menace that’s been threatening users of unprotected computers since 2018. The way this malware variant works is it encrypts all data stored on a computer using complex cryptography algorithms, then appends .llee file extensions to original filenames and finally drops _readme.txt note in the containing folder. This note suggests that the only way to restore files is to purchase LLEE file decryption tool from those behind the cyberattack.

To understand how encrypted files are renamed, see these examples: a file originally named 1.jpg becomes 1.jpg.llee, 2.txt gets renamed to 2.txt.llee and so on.

This ransomware is a typical example of a computer malware that attempts to extort the computer user after locking one’s files, or, in other words, taking them hostage. The cybercriminals store keys needed for data decryption in their servers and threaten to leave victim with one’s data locked forever if their demands are not met. Speaking of those demands, they are explained in detail in the _readme.txt note.

Ransom note explains the cybercriminals’ intentions

After finding out that all of personal files are no longer accessible due to high-security encryption used, the computer user will soon find out that attempts to restore files or reverse damage inflicted by the malware are hopeless. Therefore, the cybercriminals present a solution in the _readme.txt file. The note suggests that the ransomware has encrypted all important files including documents, photos, videos, databases and archives; in order to restore them to an original condition, the computer user has to purchase a special decryption tool along with a decryption key that specifically works for the victim’s data only.

In other words, decryption key that is used to unlock other victim’s files won’t work on other computers – unless an offline encryption type was used. For most victims, online encryption type is used, which is known by its ability to produce unique encryption/decryption key pairs per infected computer.

The _readme.txt note then introduces the price of these decryption tools: according to the attackers, the victim can purchase these for $490 as long as attempts to contact the criminals are initiated within 72 hours starting from the computer infection timestamp. If delayed any longer, the criminals won’t provide any discounts and will only provide these tools for $980. The only way to contact the attackers is via emails that are provided in the ransom note – support@bestyourmail.ch and supportsys@airmail.cc.

After contacting the criminals via email, the victim discovers that the attackers do not accept regular bank transfers and choose to rely on cryptography-based transactions only. Therefore, the crooks may instruct the victim to visit online cryptocurrency exchange platforms and purchase Bitcoin equal to the same money amount in US dollars. They will also provide a virtual wallet address so that the victim could initiate a money transfer.

For those wondering if transferring the money is a good idea, we can assure you that it is not. Even if the ransom note suggests that the criminals promise to decrypt one sample file for free, this cannot be viewed as an absolute guarantee that paying the ransom will result in a successful data decryption.

There are several reasons to back up this argument – first of all, cybercriminals are very helpful when it comes to convincing victims to make transactions to them, but their enthusiasm might diminish after receiving the money. Second, sending money to virtual criminals only helps them to fund their operations and employ more people for malware development or distribution. Next, cybercriminals often target people who have previously paid the ransom. Finally, paying the ransom might be considered an illegal activity in your country.

Remember that cybersecurity experts as well as law enforcement institutions such as FBI advise against ransom payments. Instead, it is better idea to invest in data storage drives that can be used for data backups and professional antivirus software that could prevent similar malware from damaging your computer.

Additional privacy risks associated with this ransomware attack

Getting infected with ransomware like LLEE virus is extremely dangerous not only because it leaves all of computer-stored data encrypted, but also because it spreads along information-stealing Trojans like VIDAR or AZORULT.

After sneaking into the target system, these threats are able to extract sensitive details including victim’s passwords, cookies, browsing history, cryptocurrency wallets and other valuable information. On top of that, these threats can also collect data such as computer’s name, user’s name, hardware info, installed software list and active processes.

Cybercriminals can make use of such details when planning other attacks against the victim. They might use it to blackmail the computer user and demand more money. For this reason, our team strongly advises victims of STOP/DJVU ransomware variants to get rid of the malware and change all of the passwords used on the compromised device immediately to avoid loss of private online accounts.

To remove LLEE virus, we advise booting your computer in Safe Mode with Networking and running an up-to-date antivirus from there. Make sure you use a genuine antivirus copy only. On top of that, you may want to download to repair virus damage on Windows OS files.

Ransomware Summary

REPAIR VIRUS DAMAGE

See the screenshot provided below to understand how files encrypted by this ransomware appear in computer folders.

How to avoid ransomware attacks

Ransomware-type computer threats are distributed via malicious email attachments, illegal online downloads (mostly pirated software versions or other copyright-protected content in a form of torrents or password-protected archives), fake software update tools, malicious ads and other methods.

When it comes to STOP/DJVU variants such as LLEE virus, cybersecurity experts have noticed that it almost solely relies on illegal downloads when it comes to its distribution. The cybercriminals seem to control a set of rogue websites offering “cracked” versions of various popular computer software such as Adobe Photoshop, AutoCAD, Virtual DJ Pro and others. These sites suggest that they provide downloads that would allow computer users to install and activate full versions of these programs for free. If the users fall for this scam, they end up downloading the malware either via torrent file or they get redirected to a site that “generates” a download URL of a password-protected archive with malware inside of it.

We encourage computer users to support legitimate software developers by purchasing legitimate software activation keys rather than relying on anonymous people claiming the download is “100% secure and free.” This can lead to severe damages caused to your computer.

Another popular malware distribution technique relies on malicious email attachments. Cybercriminals tend to use techniques to craft documents containing malicious scripts that are used to download the ransomware from an external source and run it on victim’s computer. If the victim opens such file without having an active antivirus protection on, the system shortly gets compromised by a file-encrypting virus.

Some of the key recommendations to avoid such malicious emails we would like to provide are:

• Avoid suspicious-looking emails that you didn’t await for.
• Check for generic greeting lines, such as “dear customer,” “Valued client” and so on. Remember that legitimate companies have your name associated with your email address and use your full name when greeting you.
• Check for grammar, spelling or typo mistakes in the email message. Legitimate companies do not leave such errors in the emails composed for their customers.
• If you can feel a sense of urgency or a threat in the email, stay away from its attachments or included links. Typical catching lines may look somewhat similar to these: “check the attached document and reply as soon as possible” or “your ___ account will be closed in 24 hours” and so on.

On top of that, computer users should avoid installing alleged software update tools from aggressive online ads that may appear on your screen during web browsing sessions. Sometimes, these ads appear when the user browses rogue websites that use less-than-reputable ad networks to generate revenue from. Downloading fake software updates can compromise the computer since they are often filled with potentially dangerous executables.

Finally, we’d like to recommend ransomware victims to rely on trustworthy online cybersecurity blogs when searching for data decryption or recovery tools. There were cases when cybercriminals related to other ransomware strains used fake STOP/DJVU decryption tools as a bait to trick people into downloading more malware on their computers. That being said, we’d like to remind you that the only confirmed and trustworthy tools capable of repairing some of STOP/DJVU encrypted files were created by Emsisoft and DiskTuna.

Remove LLEE Ransomware Virus and Repair or Decrypt .llee Files

Please follow the tutorial provided below to understand how to remove LLEE ransomware virus from your computer safely. Do not forget to use a genuine antivirus software for this task, and make sure you install required updates it to ensure that all of the newest virus’ definitions are added to its database. Afterward, consider downloading RESTORO to repair some of virus-affected Windows OS files.

Once the LLEE virus removal is finalised, do not forget to change all of your passwords (saved in web browsers or used in apps or installed programs). Afterward, you can use data backups to restore your files or try the methods explained in this guide for STOP/DJVU victims.

OUR GEEKS RECOMMEND

Our team recommends removing malware using a professional antivirus software and then using the following tool to repair virus damage to Windows system files:

REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.