QMAK ransomware uses encryption to take your files hostage, demands a ransom payment
- QMAK ransomware uses encryption to take your files hostage, demands a ransom payment
- Ransomware distribution tactics: get to know how to avoid getting infected
- More tech stats about this ransomware
- Remove QMAK Ransomware Virus and Decrypt Your Files
- Decrypt QMAK files
- Frequently Asked Questions
QMAK ransomware is a new computer virus from STOP/DJVU file-encrypting malware family. The primary aim of it is to encrypt all files on the victim’s computer and network drives with the help of Salsa20 + RSA-2048 algorithms. The virus scans all Windows PC folders, locks files found in them and adds .qmak extension to their filenames. For instance, a file called 1.jpg becomes 1.jpg.qmak and so on. To provide the victim some understanding of what just happened, the malware drops ransom note called _readme.txt in each folder. The note explains that all data can be recovered only with QMAK decryption tool, which costs either $490 or $980, depending how quickly the victim communicates with the offenders.
As usual with ransomware-type viruses, QMAK virus uses information security technologies to block the computer from accessing his/hers own files. While encryption is typically used to secure Internet communications, for example, when sending login information via HTTPS protocol, the attackers use it for malevolent purpose. Since the victim can no longer open, view or edit own files, the crooks offer a solution – pay a ransom to get a data decryption solution or never access the data again. The malware affects files like pictures, videos, audio recordings and music, documents, project files, executables, archives and other files.
The ransom note instructs the victim to contact the people behind this ransomware via two emails included in the ransom note – email@example.com and firstname.lastname@example.org. According to the message, the price of the decryption tool will be lower ($490) if the victim reaches out within 72 hours from the infection timestamp, or larger ($980) if later. The note also suggests attaching one encrypted file to the email to get it decrypted for free as a proof that the attackers can, in fact, recover your files. However, the note specifies that the victim should not send a test file that contains valuable data.
After sending an email to the attackers, the victim will receive instructions how to make the transaction. The crooks will provide links to websites where the computer user can purchase cryptocurrency (such as Bitcoin) worth the settled USD amount, and will be instructed to transfer it to the attacker’s virtual wallet. The reason why the criminals want you to pay in digital currency is because it helps them to remain anonymous and prevents FBI and other law enforcement agencies from tracking them and arresting them.
According to recommendations by cybersecurity experts worldwide as well as FBI, paying a ransom is not a recommended approach to the situation. Not only it doesn’t guarantee recovery of your files, but also makes you a potential target to further attacks. Think of it this way – the attackers will know your email address and may send you more malware via attached files. Moreover, this ransomware has a tendency to infect victim’s computer with information stealers such as AZORULT and VIDAR, both used to loot login credentials, browsing history, cryptocurrency wallets, banking details, Skype chat history and more.
With access to such information, cybercriminals can blackmail you endlessly. Ransomware operators earn millions yearly, and paying them only helps to accelerate their income, thus employ more skilled malware developers and more distributors, all leading to expansion of their operations.
It is important to secure your computer as soon as possible after becoming a victim of malware attack. In order to remove QMAK ransomware virus efficiently, we recommend using antivirus software. You must update it first so that it would have the latest malware definitions. Ideally, choose software that could protect your in real-time as well. If you do not have AV yet, our team recommends using INTEGO Antivirus, a robust security software that will block further malware attacks in real-time and also protect your network traffic. Furthermore, our team also recommends you to download RESTORO, a well-reviewed tool for repairing virus damage on Windows OS files.
|Name||QMAK Ransomware Virus|
|Type||Ransomware; Crypto-malware; Virtual Extortion Virus|
|Encryption type||RSA 2048 + Salsa20|
|Previous versions||VGKF, NQHD, ZAQI, YBER, VFGJ, FHKF, MAAK (find full list here)|
|Cybercriminal email@example.com, firstname.lastname@example.org|
|Additional malware dropped||Azorult or Vidar Trojan|
|Damage||The ransomware begins the attack on a computer after victim opens and runs a malicious torrent download. The virus then runs its processes and encrypts all of the files stored on the system and appends them with additional .qmak extension. At the same time, it drops _readme.txt ransom notes in every directory. Next, the malware eliminates Volume Shadow Copies and this ensures that the victim can no longer use System Restore points. Furthermore, the ransomware edits Windows HOSTS file to add a set of websites. This will restrict access to them, blocking the way to various computer help sites. This piece of malware is also known to carry AZORULT or VIDAR malware which is used to steal sensitive data from the infected computer.|
|Ransom demand||$490-$980 in Bitcoin|
|Distribution||Victims often download this ransomware along illegal torrent downloads, cracked software, activators, key generators or tools like KMSPico.|
|Known software cracks to contain this malware||Corel Draw, Tenorshare 4ukey, Adobe Photoshop, Cubase, Adobe Illustrator, Internet Download Manager, Tally, League of Legends.|
|Detection names||Trojan:Win32/Krypter.AA!MTB (Microsoft), Gen:Variant.Fragtor.36858 (B) (Emsisoft), UDS:Trojan.Win32.Scarsi.gen (Kaspersky), Gen:Variant.Fragtor.36858 (BitDefender), MachineLearning/Anomalous.95% (Malwarebytes), Packed.Generic.528 (Symantec) see all detection name variations on VirusTotal|
|Removal||Remove ransomware and related malware from your PC using professional software of your choice. We highly recommend using INTEGO Antivirus. To repair virus damage on Windows OS files, consider scanning with RESTORO.|
REMOVE MALWARE & REPAIR VIRUS DAMAGE
1 Step. Get robust antivirus to remove existing threats and enable real-time protection
INTEGO Antivirus for Windows provides robust real-time protection, Web Shield against phishing and deceptive websites, blocks malicious downloads and blocks Zero-Day threats. Use it to remove ransomware and other viruses from your computer professionally.
2 Step. Repair Virus Damage on Windows Operating System Files
Download RESTORO to scan your system for FREE and detect security, hardware and stability issues. You can use the scan results and try to remove threats manually, or you can choose to get the full version of software to fix detected issues and repair virus damage to Windows OS system files automatically.
Ransomware distribution tactics: get to know how to avoid getting infected
Ransomware-type computer viruses are mostly distributed via malicious email attachments, drive-by downloads and brute force attacks against vulnerable RDP services; when it comes to STOP/DJVU variants, the most common attack vector is malicious torrent downloads for pirated software or game versions. Cybercriminals prey for computer users who are willing to download premium software versions for free and suggest fake cracks, keygens and other tools used to activate paid products for free. Not only trying to access such software copies is an act of copyright infringement, but it also exposes your computer to severe security risks. Often times, users who try to download these torrents visit numerous torrent listings and download several copies from different sources just to see which one works. This can result in multiple computer infections as well, because these downloads rarely come on their own.
Victims of STOP/DJVU ransomware virus, including QMAK virus, report getting infected straight after launching one of illegal torrents for these popular software versions:
- Corel Draw;
- KMSPico (illegal Windows activation tool);
- Opera browser;
- Fifa 20;
- VMware Workstation;
- Adobe Illustrator;
- Adobe Photoshop;
- League of Legends;
- Internet Download Manager;
- Tenorshare 4ukey.
For your own safety, we recommend avoiding cracked software versions. These are often stuffed with various malware. It is also useful to know that not all of such malware will show signs of its presence on your computer instantly. Some of them might be designed to persist on your computer as long as possible without being spotted. Other malware types, often those falling under ransomware category, have idle time set up, which means that the virus will execute itself after a pre-defined time period, which can range from a few days to weeks.
The only legitimate way to get the software you want is to visit its official developer’s or its partner/affiliate website and download it from there. We can assure you that the price of a legitimate license of such software never surpasses hefty ransoms asked by greedy ransomware operators.
Another popular technique to distribute ransomware is based on malicious email attachments. The offenders try to compose as convincing messages as possible, often pretending to be victim’s colleague, boss, or a company one might communicate with on a regular basis (for instance, parcel delivery companies, e-shopping sites and etc.). The crooks inject malicious scripts into well-known document formats such as DOCX, PDF, XLS and others, then name the file as somewhat used in daily communications, for instance, “Invoice/Order Summary/Tracking Details/Waybill/Missing payment” and so on. If the victim unknowingly opens such document and, even worse, disables protected mode to edit the file, the script will download and run the ransomware executable on the system.
Our general advice is to avoid opening emails that you did not wait for. Moreover, avoid interacting with email attachments if you can notice unfamiliar greeting line, grammar errors, suspicious-looking company logos inserted into the message, or if you can sense the sender’s urgent intention for you to open attached documents. Another thing we suggest is checking whether the sender’s email address was spoofed or not.
Ransomware victims should also beware that criminals are trying to target them as well to cause double-file encryption. For instance, avoid downloading fake STOP/DJVU ransomware decryption tools as these can hide another malware inside of them. For instance, one example of such malware is ZORAB.
More tech stats about this ransomware
If you’re interested how QMAK ransomware virus carried out its functionalities while it was on your computer, this section is for you.
The ransomware begins the attack by downloading several executable files called build.exe and build2.exe. Furthermore, the virus runs a fake Windows update prompt for the victim, trying to justify the sudden system slowdown.
The virus begins by connecting to https[:]//api.2ip.ua/geo.json and saving the response into geo.json file. This file contains all information about the computer’s geolocation, includes computer’s IP address, city, zip code, latitude and longitude, country code and other details. The virus uses the collected information to determine whether the system can be encrypted or not. It has a set of exception country codes that, if detected, determines the virus not to start the data encryption procedure. The list of exception countries is provided here: Russian Federation, Uzbekistan, Syria, Armenia, Tajikistan, Ukraine, Kazachstan, Kyrgyzstan, and Belarus.
If the virus determines that the target Windows system can be encrypted, it also collects some information about the victim’s PC hardware and software. It gathers these details into information.txt file and sends it to attackers’ server. You can see an example of this file in the image below.
Additionally, the virus prepares for the attack by sending a request to its Command&Control server to get victim’s online encryption key (unique RSA-2048 key) and personal ID to associate with the infected host. The response is then saved to bowsakkdestx.txt file as well as PersonalID.txt file. At this point, it is important to mention that sometimes the ransomware fails to establish connection with its server, and if so, it uses hardcoded offline encryption key instead. An indicator of such encryption used is t1 characters at the end of PersonalID.txt file. In addition, victims affected by offline key encryption can expect to decrypt .qmak files in the future, meanwhile the online key encryption cannot be broken in any way. You can see a screenshot of these encryption-related files down below.
The ransomware then begins scanning all system directories, bypassing essential Windows operating system folders and encrypting files with a combination of Salsa20 and RSA-2048. The virus marks affected files with .qmak extensions.
The ransomware leaves an explanation in _readme.txt files dropped behind in each file directory.
Finally, the ransomware drops information-stealing Trojans on the already-infected system, for instance, AZORULT , VIDAR or another one. These Trojans are infamous for their ability to collect and transmit sensitive information from victim’s computer to the criminals’ end.
Additional modifications completed by the virus also include alteration of Windows HOSTS file. The virus has an intention to block the victim out of access to information regarding ransomware attacks, cybersecurity news, or computer user help forums. Therefore, the virus adds a list of domain names to the said HOSTS file and maps each of them to localhost IP. This causes DNS_PROBE_FINISHED_NXDOMAIN error to appear when the user attempts to open one of restricted websites.
Remove QMAK Ransomware Virus and Decrypt Your Files
If you have unfortunately fallen victim to a ransomware attack, it is important to learn how to respond to such event properly and protect yourself from similar attacks in the future. The very first thing we recommend doing is reporting cybercrime incident to your local authorities. Next, you should ensure that you have a reputable security software on your computer. Then you can use the guide given below to learn how to boot your computer in Safe Mode With Networking for a secure virus removal environment. To remove QMAK ransomware virus, we strongly suggest using an up-to-date antivirus with excellent malware detection rate. One of a kind is INTEGO Antivirus – tested and approved by our team. Additionally, we suggest you to download RESTORO and try it to repair virus damage on Windows OS files.
If you’ve completed QMAK ransomware virus removal already, we encourage you to take further steps to respond to this malware attack:
- Change all of your passwords stored on your computer (for instance, in web browser);
- Use data backups to get your files back, however, ensure that the malware is completely gone before doing so.
- Read this guide on decrypting/repairing files affected by STOP/DJVU.
OUR GEEKS RECOMMEND
Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:
QMAK Ransomware Virus Removal Guidelines
Method 1. Enter Safe Mode with Networking
Step 1. Start Windows in Safe Mode with Networking
Before you try to remove QMAK Ransomware Virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, see a video tutorial on how to do it:
Instructions for Windows XP/Vista/7 users
- First of all, turn off your PC. Then press the Power button to start it again and instantly start pressing F8 button on your keyboard repeatedly in 1-second intervals. This launches the Advanced Boot Options menu.
- Use arrow keys on the keyboard to navigate down to Safe Mode with Networking option and press Enter.
Instructions for Windows 8/8.1/10/11 users
- Open Windows Start menu, then press down the Power button. On your keyboard, press down and hold the Shift key, and then select Restart option.
- This will take you to Windows Troubleshoot screen. Choose Troubleshoot > Advanced Options > Startup Settings > Restart. Tip: If you can't find Startup Settings, click See more recovery options.
- In Startup Settings, press the right key between F1-F9 to enter Safe Mode with Networking. In this case, it is the F5 key.
Step 2. Remove files associated with the virus
Now, you can search for and remove QMAK Ransomware Virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus, which also includes data recovery software. For virus damage repair, consider using RESTORO.
Compatibility: Microsoft Windows
See Full Review
RESTORO is a unique PC Repair Tool which comes with an in-built Avira scan engine to detect and remove spyware/malware threats and uses a patented technology to repair virus damage. The software can repair damaged, missing or malfunctioning Windows OS files, corrupted DLLs, and more. The free version offers a scan that detects issues. To fix them, license key for the full software version must be purchased.
Method 2. Use System Restore
In order to use System Restore, you must have a system restore point, created either manually or automatically.
Step 1. Boot Windows in Safe Mode with Command Prompt
Instructions for Windows XP/Vista/7 users
- Shut down your PC. Start it again by pressing the Power button and instantly start pressing F8 button on your keyboard repeatedly in 1-second intervals. You will see Advanced Boot Options menu.
- Using arrow keys on the keyboard, navigate down to Safe Mode with Command Prompt option and press Enter.
Instructions for Windows 8/8.1/10/11 users
- Launch Windows Start menu, then click the Power button. On your keyboard, press down and hold the Shift key, and then choose Restart option with the mouse cursor.
- This will take you to Windows Troubleshoot screen. Choose Troubleshoot > Advanced Options > Startup Settings > Restart. Tip: If you can't find Startup Settings, click See more recovery options.
- In Startup Settings, press the right key between F1-F9 to enter Safe Mode with Command Prompt. In this case, press F6 key.
Step 2. Start System Restore process
- Wait until system loads and command prompt shows up.
- Type cd restore and press Enter, then type rstrui.exe and press Enter. Or you can just type %systemroot%system32restorerstrui.exe in command prompt and hit Enter.
- This launches System Restore window. Click Next and then choose a System Restore point created in the past. Choose one that was created before ransomware infection.
- Click Yes to begin the system restoration process.
After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won't be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.
Alternative software recommendations
Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.
System Mechanic Ultimate Defense
If you're looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek's Advice approval. Get it now for 50% off. You may also be interested in its full review.
Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.
Decrypt QMAK files
Fix and open large QMAK files easily:
It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.
- Create a copy of encrypted file to a separate folder using Copy > Paste commands.
- Now, right-click the created copy and choose Rename. Select the QMAK extension and delete it. Press Enter to save changes.
- In the prompt asking whether you want to make the changes as file might become unusable, click OK.
- Try opening the file.
STOP/DJVU decryption tool usage guide
STOP/DJVU ransomware versions are grouped into old and new variants. QMAK Ransomware Virus is considered the new STOP/DJVU variant, just like VGKF, NQHD, ZAQI, YBER, VFGJ, FHKF, MAAK (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie.
Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible.
In order to test the tool and see if it can decrypt QMAK files, follow the given tutorial.
- Download the decryption tool from Emsisoft.
- Click the little arrow next to your download and choose Show in Folder.
- Now, right-click the file and choose Run as Administrator. If asked, enter administrator's password.
- In UAC window, click Yes.
- Click Yes to agree to software terms in both windows.
- The tool will automatically include C:// disk as a location to decrypt. The file recovery tool will prepopulate the locations to scan, including connected data storage drives or network drives. Click Add folder if you wish to add additional locations.
In Options tab, you can choose to keep encrypted file copies. We recommend leaving this option selected, especially if you do not know if the decryption tool will work.
- Click Decrypt to start restoring QMAK files. You will see the progress in the Results tab. Here, you can see messages from the tool, such as whether the decryption procedure is successful, or you need to wait for an update.
You might also be informed that online key was used to encrypt your files. In such case, the decryption tool won't work for you, and the only way to recover your files is to use a data backup.
Meanings of decryptor's messages
The QMAK decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages:
Error: Unable to decrypt file with ID: [example ID]
This message typically means that there is no corresponding decryption key in the decryptor's database.
No key for New Variant online ID: [example ID]
Notice: this ID appears to be an online ID, decryption is impossible
This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible.
Result: No key for new variant offline ID: [example ID]
This ID appears to be an offline ID. Decryption may be possible in the future.
If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn't available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your QMAK extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.
Report Internet crime to legal departments
Victims of QMAK Ransomware Virus should report the Internet crime incident to the official government fraud and scam website according to their country:
- In the United States, go to the On Guard Online website.
- In Australia, go to the SCAMwatch website.
- In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.
- In Ireland, go to the An Garda Síochána website.
- In New Zealand, go to the Consumer Affairs Scams website.
- In the United Kingdom, go to the Action Fraud website.
- In Canada, go to the Canadian Anti-Fraud Centre.
- In India, go to Indian National Cybercrime Reporting Portal.
- In France, go to the Agence nationale de la sécurité des systèmes d’information.
If you can't find an authority corresponding to your location on this list, we recommend using any search engine to look up "[your country name] report cyber crime". This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities.
Another recommendation is to contact your country's or region’s federal police or communications authority.
Frequently Asked Questions
You can only open QMAK files if you have the decryption key, or if you were affected by offline encryption type.
To figure out whether you were affected by offline encryption, please go to C:/SystemID/PersonalID.txt and see if the string inside of it ends in t1. You can also try using Emsisoft Decryptor for STOP/DJVU.
Please follow the guidances provided by the official QMAK decryption tools and believe what they say. If they say it is impossible to decrypt, it really is so. There is no magic tool or human capable of decrypting your files hiding somewhere. Encryption is a technique created to be nearly impossible to decrypt without a special private key (held by the criminals).
We advise scanning with anti-virus, anti-malware, malware removal tools or software like RESTORO to eliminate virus damage on the system. If you do not trust using a single tool, try running one after another. However, we do not recommend keeping several security programs on a computer at once as they can interfere with each other's work.
Beware of fake QMAK decryption tools circulating around the web. Cyber criminals are uploading them to various shady websites, also might be promoting them via suspicious Youtube videos. These programs can infect your computer even more heavily (Trojans, miners, etc.). We suggest being extremely cautious around the web. If there will be an official STOP/DJVU decryption tool available, it will be widely discussed in public media.
Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.