Geek's Advice

NQHD ransomware uses Salsa20+RSA-2048 to encrypt files on victim’s computer

NQHD ransomware is a nascent malicious computer virus that belongs to the STOP/DJVU ransomware family. This dangerous virus is known to function by encrypting files stored in any computer it infiltrates while appending .nqhd extension to all filenames. Take for instance, a file that was hitherto known as 1.jpg will be automatically renamed as 1.jpg.nqhd and the same format is applied repeatedly to all files. Also, while the attack is still going on, the ransomware will equally drop a ransom note called _readme.txt in all the folders. Contained in the _readme.txt note is a message from the cybercriminals behind the attack, informing the victim to contact them in order to pay a ransom in exchange for NQHD decryption tool.

They will emphasize that NQHD malware has encrypted every file contained in the computer, with the use of very strong and unique encryption key. Therefore, if they hope to ever retrieve their encrypted files, then they would have to pay a certain amount of money as ransom to the cybercriminals before they would decrypt the files. Two emails: support@sysmail.ch and helprestoremanager@airmail.cc will be dropped as well for further correspondence.

In addition to that, they will include decryption prices with conditions attached to it, such as possible discounts provided the victim responds ASAP to their demand. They will state that if the victim responds within 72 hours i.e. three days of being notified, they will be entitled to a 50% discount. In other words, instead of paying $980, they will only have to pay $490. However, once three days elapse, only the full payment will be acceptable.

Peradventure the victim decides to contact them through the email address, he will be informed that payment can only be made by purchasing cryptocurrency equivalence of the ransom and transferring same to their own wallet address. They obviously opt for this channel in order to cover their tracks and preempt any possibility of being arrested. To assure the victim of their expertise, they may request for any random file to be sent to them for test decryption, but will equally add a clause that such file shouldn’t contain important information.

Whatever be the situation, our in-house cybersecurity experts generally advise against any form of ransom payment and this standpoint is also recommended by the FBI. Victims should always remember that paying the ransom does not guarantee that encrypted data will be recovered. Also, whenever ransom is paid to cybercriminals, it encourages them and enhances their capacity to inflict more damage on increased number of victims, thereby enabling a vicious cycle.

Worse still, the virus is known to drop Trojans like AZORULT and VIDAR on the compromised computer and these Trojans often steal sensitive personal information such as banking details, browsing history, software login details, cryptocurrency wallets, passwords saved on browser etc. without the victim being aware, thus opening up more chances for possible further blackmail.

Victims of STOP/DJVU variant should endeavor to remove NQHD ransomware virus from their computer as quickly as possible. To do this effectively, they can make use of any strong antivirus software while their computer is on Safe Mode/Networking. This mode set up will make it easy for the malware to be detected and removed. However, it is important to make use of trusted antivirus while doing this. If you do not have one, then we recommend going for RESTORO to identify and repair virus damage on Windows OS files.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Ransomware distribution techniques used by cybercriminals

More often than not, computer users tend to become infected with STOP/DJVU malware variants such as NQHD virus when they download from online malicious torrents. The cybercriminals usually hide the malware in pirated software copies such as key generators or “cracks,” among other illegal license activation tools and they become triggered when users download them on their computers. Some of the most popular ones they upload to different online torrent libraries are listed below:

• Cubase;
• Tenorshare 4ukey;
• AutoCad;
• Opera browser;
• Corel Draw;
• VMware Workstation;
• Fifa 20;
• Adobe Photoshop;
• League of Legends;
• Internet Download Manager;
• KMSPico (illegal Windows activation tool).

Any computer user that has a habit of visiting online torrents libraries should desist from doing so to avoid becoming victim ransomware. Cybercriminals usually take advantage of greedy users who want to download copyrighted software contents illegally, only to end up unleashing dangerous malware on their computer. Aside the risk of falling victim to ransomware, illegally downloading such contents can lead to possible prosecution. Therefore, instead of getting involved in such risky activity, it is much better to pay the license fee as advertised by the original content developers which is significantly lower than the outrageous ransom demands cybercriminals place on their victims. Also, there won’t be any risk of blackmail or loss of sensitive/important data.

Another channel used by cybercriminals to spread malware is through malicious email attachments, whereby they create seemingly real messages alongside attachments using certain formats, particularly XLS, PDF or DOCX. They make use of these particular platforms simply because they enable macro functions and JavaScript, which can be used to attach payload that would be triggered when downloaded on a computer.

Unfortunately, it can be difficult to decipher if a particular email is coming from genuine sources or carrying malicious email attachments from cybercriminals. This is because these rogues have increasingly become more sophisticated and now go as far as impersonating popular brands like Amazon, DHL or eBay etc. Also, they often use enticing names like Invoice, Order Summary or Tracking Details as baits. On the other hand, they sometimes make use of email spoofing techniques to hide the actual sender’s email address. Therefore, it is imperative to avoid opening any email you’re not convinced about its intentions.

Nevertheless, those that are victims already shouldn’t throw caution to the wind and start seeking for decryption solutions from dubious sites claiming to offer them because such do not exist. On the contrary, cybercriminals behind them have ulterior motives and they usually spread other family variants like ZORAB while offering them as STOP/DJVU decryptors. Downloading them can only worsen an already bad situation.

Further details about the virus

This section explains further about what happens while NQHD ransomware attack is ongoing. It covers the technical aspect of the ransomware attack and the extent to which it affects your computer. The first thing the malware does is to establish build.exe or build2.exe as well as winupdate.exe that is, the prompt that displays fake Windows screen. The malware then makes a connection with https[:]//api.2ip.ua/geo.json before saving the result in geo.json file. Afterwards, it then begins data gathering whereby every relevant detail about the computer will be extracted such as the computer’s geolocation, time zone, zip code, longitude and latitude (geo.json file) as well as hardware and software information into information.txt file, and forwards them to its database/server. Shown below is an image depicting geo.json file.

You can also see a screenshot of information.txt created by the ransomware.

The malware then makes use of the geolocation information to detect if the computer is located in any of their encryption-exempted countries listed as Russia, Ukraine, Belarus, Krygyzstan, Syria, Uzbekistan, Kazachstan, Armenia and Tajikistan. If it reads positive, they will abort the operation but if otherwise, they will move to the next stage where it will extract from the server; the online encryption key and also the victim’s ID and would later save them in bowsakkdestx.txt file and to PersonalID.txt file. You can check the images below to see an example of this file.

If/when the virus couldn’t extract an online encryption ID; it will resort to the use of an offline encryption ID. The difference between them is that while online ID is unique to each victim, the offline one is uniform for all victims. You can detect if an offline key was used if an ID has t1 characters appearing at the end of it. An offline ID increases the hope of the victim to be able to decrypt .nqhd files someday. More details about this is provided below.

The ransomware will at this juncture, commence full data encryption by scanning the entire folders and encrypting the files with Salsa20, and afterwards, it will now lock the encryption using RSA-2048 key. While this process is still ongoing, it will mark each file with a new additional extension.

Shown in the image below is a screenshot of _readme.txt ransom note that is dropped in each folder.

The next thing it does is to delete all Volume Shadow Copies by leveraging the Command Prompt task as shown below:

^{vssadmin.exe Delete Shadows /All /Quiet}

Before wrapping up the attack, the virus will add a list of domains to the Windows HOSTS file and then sends them to the localhost IP. This move practically prevents the victim from having any access to the blacklisted websites. When the victim tries to visit any of the blacklisted websites, they will encounter DNS_PROBE_FINISHED_NXDOMAIN error message. The simple reason why the cybercriminals do this is to prevent the victim from being able to visit certain online sites that provide advise/support.

The ransomware then releases even more malware such as VIDAR or AZORULT Trojan on the already compromised computer.

Remove NQHD Ransomware Virus and Recover Your Files

For victims whose files were encrypted by this variant of ransomware, it will be in your best interest to report the incident to local authorities mandated to handle such issues and also remove NQHD ransomware virus as quickly as possible (the steps provided below can guide you on this). However, always remember to set up your computer on the Safe Mode with Networking option before trying to use antivirus in removing the malware. This option optimizes the process and prevents the malware from hindering the removal. It is also important to note that while there are several genuine antivirus software copies available in the market, there are also lots of ineffective ones. So, you should be wary of the antivirus you’re opting for. Due to this factor, we recommend INTEGO Antivirus because it has proven to be very reliable.

The following steps should be taken immediately before or after NQHD ransomware virus removal:

• Get in touch with the designated local law enforcement agency assigned to handle cybercrime and related issues.
• Restore lost data using your backup device but ensure there is no trace of the virus left before plugging any external storage device.
• Study possible ways one can repair data damaged by STOP/DJVU variants.
• Replace all existing passwords used on the compromised computer with new ones.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.