Geek's Advice

QBAA ransomware aims to lock your computer files for a ransom

QBAA ransomware is a malicious virus that viciously attacks computers by encrypting all files contained in them. This latest malware is a member of the infamous STOP/DJVU ransomware group. After encrypting files it will append .qbaa extension to each of them respectively. For example, a file that was formerly known as 1.jpg will be automatically renamed 1.jpg.qbaa. While the cyberattack is still taking place, ransom notes named as _readme.txt will also be dropped in all the folders. Contained in this ransom notes are notifications from the cybercriminals informing the victim about what just happened and the need for them to respond quickly by paying certain fees as ransom in exchange for the QBAA decryption tool.

They will go further to explain that QBAA ransomware virus was able to encrypt all files contained in the infected computer such as documents, pictures and every other data and since they made use of a very strong and complex key, there won’t be any possibility of reversing it by the victim excerpt they pay a ransom fee to them. To facilitate further discussions between them, the cybercriminals will also include two email addresses (support@mailtemp.ch and supportsys@airmail.cc) in the ransom notes so the victim would be able to respond to them.

In addition to that, decryption service prices will also be included as well as information about terms of payment. Due to their desperation to receive ransom payment ASAP, they will claim that victims would be able to leverage a 50% discount if they can pay within 3 days or 72 hours of being notified, which brings the ransom fee down to $490. However, failure to meet up within that deadline means only the full ransom fee of $980 would be acceptable.

However, if the victim contacts them, the cybercriminals will give further directives that cash payment is not allowed, instead payment can only be made by purchasing cryptocurrency valued at the same amount with the ransom fee and would be transferred to a wallet address of their choice. The apparent reason why they make use of such an anonymous payment system is to preempt any chance of being trailed by law enforcement agents who may come after them. To assure the victim of their capability to decrypt their encrypted files, they may suggest for parts of the files to be forwarded to them for test decryption. Nevertheless, they will add that such parts must not contain information they may deem as vital to the victim.

Whatever be the case, our cybersecurity experts recommend that victims should follow FBI guidelines when dealing with issues bordering on ransom payment, and the policy is that ransom must not be paid. You should bear in mind that paying ransom does not guarantee that victims will ultimately recover their lost data. Another reason is that paying ransom will only encourage cyber criminals to continue victimizing others so they could also extort them.

Worse still, this virus is known for dropping other Trojans such as VIDAR and AZORULT that steal vital information from the already compromised computer, like software account login details, cryptocurrency wallets, banking details, browsing history and passwords etc. Loss of such sensitive data can lead to more fraudulent acts such as blackmail and theft.

For those that are already victims of STOP/DJVU ransomware, it would be in your best interest to remove QBAA ransomware as fast as you can. The best way to go about it is by setting up the infected PC in Safe Mode with Networking before running a reliable antivirus on it. It is important to make use of only genuine antivirus, but if you’re not convinced about any particular one then we strongly recommend INTEGO Antivirus. In addition, many computer users swear by this PC repair software which helps to repair damaged Windows OS files after virus attack without the need to reinstall the OS. You can download it here – RESTORO.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Ransomware distribution techniques used by cybercriminals

Computer users usually get their PC infected with different variants of STOP/DJVU ransomware virus including QBAA virus following downloads from online malicious torrents. It should be noted that cybercriminals often hibernate malware in pirated software contents including the so-called key generators and “cracks” which they use as baits in luring their victims. Therefore, downloading from online malicious torrents or trying to make use of such content is highly discouraged. Over the years, certain popular but pirated versions of software are mostly used by cybercriminals as listed below:

• Adobe Photoshop;
• Adobe Illustrator;
• AutoCad;
• Tenorshare 4ukey;
• Opera browser;
• Corel Draw;
• VMware Workstation;
• Cubase;
• Fifa 20;
• League of Legends;
• Internet Download Manager;
• KMSPico (illegal Windows activation tool).

For those that have already formed the habit of indulging in such risky activities such as visiting software torrents online, it is high time you desist from doing so forthwith to avoid becoming a prey to cybercriminals. It is not a good idea to try activate copyright software contents or to gain access to game versions without paying the necessary fees requested by their legitimate developers. On the contrary, it is better to support such genuine software content developers by patronizing them or their third-party affiliates. Also, remember that whatever fee you are charged will always be little in comparison to outrageous amounts usually demanded by cybercriminals as ransom fee, and neither will there be any threat to your vital/sensitive documents.

Another way used in distributing ransomware is through malicious email attachments in which cybercriminals often create extremely convincing messages that would be accompanied by attachments crafted on platforms like PDF, XLS, or DOCX. These particular ones are often used because they enable macro functions and JavaScript, both of which can be used in attaching, transporting and triggering payloads from external sources to random computers.

The problem here is that trying to decipher which email is genuine or sent by cybercriminals can be quite difficult. The reason is because these rogue developers has increasing become sophisticated in their criminal activities by impersonating as acquaintances or even as popular brands like Amazon, eBay, FedEx, DHL etc. They will also use compelling names such as Order Summary, Invoice or Tracking Details among other similar names as the case may be. Alternatively, they may even decide to completely obfuscate the originating address with the use of email spoofing techniques. Whatever method they try to use, you’re advised to trust your intuition and ignore emails that are unexpected or seemingly inappropriate.

Lastly, victims of STOP/DJVU virus should abstain from certain dubious websites that claim to offer amazing decryption solutions because they’re mostly fraudulent and have bad motives. Only a couple of brands known as Emsisoft and DiskTuna have proven track record of providing such services effectively.

More technical details about the malware

This section explains more about the technical aspects of this ransomware and what actually happens during QBAA ransomware attack. The first thing the malware does is to launch build.exe or build2.exe executables as well as winupdate.exe (the window that displays fake ongoing Windows update progress). The virus then makes a connection with https[:]//api.2ip.ua/geo.json and would save the outcome in geo.json file. The malware then commences information gathering of details such as the computer’s geolocation, time zone, zip code, longitude and latitude, and would store them in its geolocation database. Here are two screenshots of geo.json file to demonstrate how examples of this file appear.

The malware then creates another file for storing computer’s name, infection timestamp, hardware details, installed software list and active processes at the time of the attack. This file will be named as information.txt and forwarded to cybercriminals’ server.

Furthermore, the malware will profile the country code of the computer against their own list of encryption-exempted countries namely; Russian Federation, Syria, Ukraine, Armenia, Tajikistan, Kyrgyzstan, Kazachstan, Uzbekistan and Belarus. If it detects that the location of the computer is within any of these countries, it will immediately cease its actions but if it scales through the geolocation test, it will then extract online encryption key from their server and would combine it with the victim’s ID before saving them in bowsakkdestx.txt file and also to PersonalID.txt file. Shown below is an example of how these files appear.

In cases whereby the malware could not extract any online encryption key, it will then opt for the use of a hardcoded offline key which would be uniform for all victims of the same virus variant. You can easily decipher if an offline key was used if it contains t1 characters suffixed to the victim’s personal ID. The use of offline key is advantageous to the victim since it raises hope of decrypting .qbaa files going forward. You can check below for more information pertaining to this.

Now it has gotten to this stage, the ransomware will commence full data encryption procedure by scanning every folder and encrypting them with Salsa20 before using RSA-2048 to lock the encryption key. Also, while this is going on, it will mark all other files with extra extensions.

Displayed in the image below is a screenshot of _readme.txt ransom note that is often left in all the folders.

Next in line will be the deleting of Volume Shadow Copies by making use of the command prompt task as written below:

^{vssadmin.exe Delete Shadows /All /Quiet}

Lastly, will compile a list of certain domains and will add them to the Windows HOSTS file as well as the localhost IP. This is done to prevent any attempt by the victim to seek help from any of the blacklisted sites that are known to offer support to victims of cyber-attack. The error message DNS_PROBE_FINISHED_NXDOMAIN may appear whenever they try to access any of them.

Remove QBAA Ransomware Virus and Recover Lost Files

Victims of this ransomware and indeed all others should as a matter of urgency remove QBAA ransomware virus from the infected computer by setting up their computer in Safe Mode with Networking as stated earlier and also make use of any genuine antivirus such as INTEGO Antivirus to ensure the computer has become safe again. Moreover, we recommend downloading RESTORO to inspect the computer for malware remains and repair virus damage to Windows OS files.

Please go through these steps once QBAA ransomware virus removal is completed as recommended by our team:

• Inform local authorities assigned to handle such issues about the cyber-attack.
• Search for existing data backup drives to restore lost data.
• This is the time to learn possible ways of repairing files damaged by STOP/DJVU ransomware variants.
• Change all login credentials that were used on the malware-infected computer.

Nevertheless, it is always best to be proactive by avoiding online activities that could put your PC at danger of being infected with a virus, as outlined in this article.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.