Contents
QNTY ransomware is a malicious file-encrypting computer malware that just came out from the STOP/DJVU ransomware family. This virus operates by encrypting every file it can find on any computer it compromises before appending .qnty extension to each of them respectively. Take for example, an existing file originally called 1.jpg will be renamed to 1.jpg.qnty and same process will be applied on all others. During the attack, ransom notes known as _readme.txt will also be released by the ransomware in all the folders. These notes contain information from the cybercriminals notifying the victim about what just happened and briefly explains why they would have to a ransom fee in order to receive QNTY decryption tool.
The cybercriminals would emphasize in the note that QNTY ransomware virus has encrypted every file/data found in the computer system thereby making them unusable, and since they made use of very strong encryption key, the victim has no other option than to pay a ransom fee that will qualify them to receive a decryption tool. Also included will be two email addresses obviously dropped for the victim so they could have a means of reaching out to them. The email addresses are: support@sysmail.ch and helprestoremanager@airmail.cc.
And lastly, the note will contain decryption service prices as well as conditions of payment. They will instruct that payment has to be made without delay and to influence the victim to comply ASAP; it will state that should payment be made within a 3-day period i.e. 72 hours, there would be 50% discount. In other words, instead of paying a ransom fee of $980, the victim will now have to pay $490 but once 3 days elapses, only the full ransom fee will be acceptable.
However, once the victim contacts them through any of the email they provided, the cybercriminals will state categorically that payment can only be made through cryptocurrency. Therefore, the victim would have to purchase cryptocurrency that is worth the ransom fee and transfer it to their wallet address. The apparent reason why they use this option is to avoid the risks associated with other medium of payment that could lead to their arrest, thus they chose a medium that will protect their identity. They may also request for parts of the encrypted files to be sent to them for test decryption as a way of convincing the victim but they will warn that such excerpt must not contain data that could be perceived as important.
Our team of cybersecurity experts advises people to follow FBI’s guidelines pertaining to ransom payments and it states that on no account should ransom be paid. There are several reasons why this recommendation was put forward and they’re displayed below:
It does not end there; the virus is also capable of dropping Trojans like AZORULT and VIDAR that can covertly steal information from the already compromised computer such as banking details, software login details, computer-saved passwords, cryptocurrency wallets and browsing history among others. Such sensitive information in the wrong hands can result in more scams.
Those that have been infected with any of the STOP/DJVU ransomware variants should remove the QNTY ransomware as quickly as possible to avert any further damage. The best way to remove it is by setting up your computer in Safe Mode with Networking before activating any strong antivirus on the infected computer. If you’re not sure about which antivirus to use, then you can make use of INTEGO Antivirus recommended by our experts. In addition to that, you should also download RESTORO which you can use to repair any damage to your Windows OS files.
Name | QNTY Ransomware Virus |
Type | Ransomware; Crypto-malware; Virtual Extortion Virus |
Family | STOP/DJVU |
Encryption type | RSA 2048 + Salsa20 |
Previous versions | VYIA, QBAA, FOPA, VTYM, KQGS, XCBG, BPQD (find full list here) |
Version | 393rd |
Extension | .qnty |
Cybercriminal emails | support@sysmail.ch, helprestoremanager@airmail.cc |
Additional malware dropped | Azorult or Vidar Trojan |
Damage | The ransomware encrypts all files on the infected computer, adding .qnty extension to original filenames. It then leaves _readme.txt ransom note in every affected data folder. This malware is also known to carry VIDAR Stealer. The ransomware may also delete Volume Shadow Copies and modify Windows HOSTS file to restrict computer user’s access to cybersecurity-related websites online. |
Ransom note | _readme.txt |
Ransom demand | $490-$980 in Bitcoin |
Distribution | Victims often download this ransomware along illegal torrent downloads, cracked software, activators, key generators or tools like KMSPico. |
Known software cracks to contain this malware | Corel Draw, Tenorshare 4ukey, Adobe Photoshop, Cubase, Adobe Illustrator, Internet Download Manager, Tally, League of Legends. |
Detection names | Ransom:Win32/StopCrypt.PAL!MTB (Microsoft), Trojan.Crypt (A) (Emsisoft), HEUR:Trojan-Ransom.Win32.Stop.gen (Kaspersky), Trojan.GenericKD.47850419 (BitDefender), Trojan.MalPack.GS (Malwarebytes), ML.Attribute.HighConfidence (Symantec) see all detection name variations on VirusTotal |
Removal | Remove ransomware and related malware from your PC using professional software of your choice. We highly recommend using INTEGO Antivirus. To repair virus damage on Windows OS files, consider scanning with RESTORO. |
REMOVE MALWARE & REPAIR VIRUS DAMAGE
1 Step. Get robust antivirus to remove existing threats and enable real-time protection
INTEGO Antivirus for Windows provides robust real-time protection, Web Shield against phishing and deceptive websites, blocks malicious downloads and blocks Zero-Day threats. Use it to remove ransomware and other viruses from your computer professionally.
2 Step. Repair Virus Damage on Windows Operating System Files
Download RESTORO to scan your system for FREE and detect security, hardware and stability issues. You can use the scan results and try to remove threats manually, or you can choose to get the full version of software to fix detected issues and repair virus damage to Windows OS system files automatically.
Most victims of STOP/DJVU ransomware variants including QNTY virus got infected after downloading from malicious online torrents. The cybercriminals will upload pirated software copies that are loaded with virus and they become triggered in random computers after they are downloaded by unsuspecting users. Therefore, the use key generators, “cracks” and any other fake software copies are highly discouraged. Over the years, victims of ransomware have often reported about ransomware attack after exposing themselves to some of these fake software contents. From our list so far, the most common pirated software contents that are often uploaded to online torrents platforms are listed below:
For those that have a penchant for visiting online torrents platform, you’re hereby advised to desist from doing so. You will vulnerable to ransomware attack any single moment you spend in such places. Trying to download key generators, so-called cracks or to gain access to paid game versions at no cost is akin to going through a field filled with landmines. These illegal software contents are baits used by cybercriminals to get their victims. Also, making use of copyrighted software contents illegally is subject to civil penalties and is punishable by law.
Instead of risking all these, it is much better to do the right thing by going to the recognized official pages of the original content producers and pay whatever license fees that is required so you can obtain them legitimately. The license fee is always affordable unlike the outrageous ransom fees cybercriminals demand from their victim. In addition to that, you won’t be at risk of losing important/sensitive data.
Another distribution method used by cybercriminals is malicious email attachments whereby they compose highly convincing messages that would be attached with documents formatted on XLS, DOCX, PDF or similar ones that allow JavaScript or other macro functions that can be used to upload and trigger payload in other computers.
The problem is that trying to decipher which email is genuine or from cybercriminals can be quite difficult. This is because these rogues have devised means of impersonating others. They usually pretend to be FAM or from well-known brands like DHL, eBay, UPL or Amazon etc. and equally use official terms like Tracking Details, Invoice or Order Summary. They may even decide to use email spoofing techniques that would obfuscate the actual sender’s email address. Whatever gimmick they use, you’re advised to thread with caution anytime you receive an email whose source is not clear enough.
For victims of STOP/DJVU ransomware, it would be in your best interest to stay away from suspicious websites that claim to provide decryption solutions. These are dubious claims because such solutions hardly exist. Currently, only Emsisoft and DiskTuna have tools that are verified to be effective. However, others only want to spread other versions of ransomware like ZORAB disguised as fake STOP/DJVU decryptors. Downloading them would likely lead to double-file encryption.
Complex activities take place during QNTY ransomware attack, so this section explains what actually happens and how much it affects the computer. The first thing that occurs during a ransomware attack is the setting up of build.exe or build2.exe executables and also winupdate.exe (this is a prompt that shows a fake Windows update display).
Afterward, the virus will connect with https[:]//api.2ip.ua/geo.json, and the response will be forwarded to the geo.json file. It will then begin gathering every detail concerning the computer under attack, such as the computer’s geolocation, time zone, zip code, latitude, and longitude, and would save them accordingly before creating another file information.txt where hardware details, installed software list and other processes will be stored. Shown in the screenshot below is an example of geo.json file.
See a screenshot of information.txt file below.
At this point, the virus will make use of the geolocation information to detect if it is domiciled in any of their encryption-exception countries listed as Russia, Syria, Kyrgyzstan, Armenia, Tajikistan, Uzbekistan, Ukraine, Kazachstan, and Belarus. If they find out it actually belongs to any of the countries, they will immediately abort their mission. However, if otherwise, the malware will now fetch online encryption key from their server and would join it to the victim’s ID before saving them in bowsakkdestx.txt file and to PersonalID.txt file. Examples of these files are shown in the screenshot below.
Failure to extract any online encryption key (this situation occurs in case the virus fails to establish connection with Command&Control server), it will settle for an offline key version. The difference between both keys is that offline key is hardcoded into the ransomware and is used per all offline-encryption victims while the online key obtained from Command&Control server is strictly unique for every victim.
The implication is that with offline key, the victim can hope to decrypt .qnty files going forward but such chances is limited with online key encryption. An indication of offline key usage is t1 characters at the end of the victim’s ID (you can check this by opening C:\SystemID\PersonalID.txt file). Read more about it here.
Afterwards, the ransomware will begin full data encryption process whereby it will scan every folder and also encrypts them with Salsa20 before locking the encryption key using RSA-2048. While this process is still ongoing, the virus will mark each file with extra extension identical to the ransomware’s variant name.
The image below shows _readme.txt ransom note the malware drops in all the folders.
The next the virus does is to delete Volume Shadow Copies using command prompt shown here:
vssadmin.exe Delete Shadows /All /Quiet
In completing the process, the malware will blacklist certain domains in the Windows HOSTS file and when/if the victim tries to gain access to them, an error message: DNS_PROBE_FINISHED_NXDOMAIN may appear on the screen.
You’re advised to remove QNTY ransomware virus as quickly as you can once it is detected in your computer. You can get this done by booting your computer through Safe Mode with Networking before running any reputable antivirus on it, to ensure optimal result. This is very important and if you’re not sure about the antivirus to use, then you should consider making use of INTEGO Antivirus because it has been tested by us and certified to be perfect.
Once QNTY ransomware removal is complete, please follow the steps below as recommended by our team:
OUR GEEKS RECOMMEND
Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:
GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.
QNTY Ransomware Virus Removal Guidelines
Before you try to remove QNTY Ransomware Virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube.
Instructions for Windows XP/Vista/7 users
Instructions for Windows 8/8.1/10/11 users
Now, you can search for and remove QNTY Ransomware Virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus, which also includes data recovery software. For virus damage repair, consider using RESTORO.
Special Offer
Compatibility: Microsoft Windows
See Full Review
RESTORO is a unique PC Repair Tool which comes with an in-built Avira scan engine to detect and remove spyware/malware threats and uses a patented technology to repair virus damage. The software can repair damaged, missing or malfunctioning Windows OS files, corrupted DLLs, and more. The free version offers a scan that detects issues. To fix them, license key for the full software version must be purchased.
In order to use System Restore, you must have a system restore point, created either manually or automatically.
Instructions for Windows XP/Vista/7 users
Instructions for Windows 8/8.1/10/11 users
After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won't be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.
Malwarebytes Anti-Malware
Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.
System Mechanic Ultimate Defense
If you're looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek's Advice approval. Get it now for 50% off. You may also be interested in its full review.
Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.
It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.
STOP/DJVU ransomware versions are grouped into old and new variants. QNTY Ransomware Virus is considered the new STOP/DJVU variant, just like VYIA, QBAA, FOPA, VTYM, KQGS, XCBG, BPQD (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie.
Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible.
In order to test the tool and see if it can decrypt QNTY files, follow the given tutorial.
The QNTY decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages:
Error: Unable to decrypt file with ID: [example ID]
This message typically means that there is no corresponding decryption key in the decryptor's database.
No key for New Variant online ID: [example ID]
Notice: this ID appears to be an online ID, decryption is impossible
This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible.
Result: No key for new variant offline ID: [example ID]
This ID appears to be an offline ID. Decryption may be possible in the future.
If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn't available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your QNTY extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.
Victims of QNTY Ransomware Virus should report the Internet crime incident to the official government fraud and scam website according to their country:
If you can't find an authority corresponding to your location on this list, we recommend using any search engine to look up "[your country name] report cyber crime". This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities.
Another recommendation is to contact your country's or region’s federal police or communications authority.
You can only open QNTY files if you have the decryption key, or if you were affected by offline encryption type.
To figure out whether you were affected by offline encryption, please go to C:/SystemID/PersonalID.txt and see if the string inside of it ends in t1. You can also try using Emsisoft Decryptor for STOP/DJVU.
Please follow the guidances provided by the official QNTY decryption tools and believe what they say. If they say it is impossible to decrypt, it really is so. There is no magic tool or human capable of decrypting your files hiding somewhere. Encryption is a technique created to be nearly impossible to decrypt without a special private key (held by the criminals).
We advise scanning with anti-virus, anti-malware, malware removal tools or software like RESTORO to eliminate virus damage on the system. If you do not trust using a single tool, try running one after another. However, we do not recommend keeping several security programs on a computer at once as they can interfere with each other's work.
Beware of fake QNTY decryption tools circulating around the web. Cyber criminals are uploading them to various shady websites, also might be promoting them via suspicious Youtube videos. These programs can infect your computer even more heavily (Trojans, miners, etc.). We suggest being extremely cautious around the web. If there will be an official STOP/DJVU decryption tool available, it will be widely discussed in public media.
Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.
Private Internet Access (PIA) VPN maintains its long-term role as a leader Private Internet Access…
XCBG ransomware aims to lock your files and demand a ransom XCBG ransomware is a…
BPQD ransomware encrypts all computer files, demands a ransom from the user BPQD ransomware is…
KQGS ransomware is a hostile computer virus designed to encrypt all of your files KQGS…
VTYM ransomware description: a virtual menace to your files stored on the computer VTYM ransomware…
FOPA ransomware is a new threatening computer virus that encrypts your files FOPA ransomware virus…
This website uses cookies.