Geek's Advice

QQQW ransomware strikes computer users who download pirated software versions

QQQW ransomware is a malicious file-encrypting computer virus that is released by STOP/DJVU ransomware operators. This malware mostly hides in illegal torrents, such as pirated software versions. Once on the computer system, the virus encrypts all files stored on it and connected drives, adds .qqqw extension to each file and drops a ransom note called _readme.txt in every scanned folder. For instance, a file that previously was called 1.jpg appears as 1.jpg.qqqw once the ransomware encrypts it. The ransom note left for the victim delivers a message from cybercriminals who suggest that the only way to recover encrypted files is paying a ransom in exchange for QQQW decryption tool.

The sole aim of QQQW ransomware is to put encryption algorithms for bad use and extortion of the computer user – therefore, it uses a combination of Salsa20 and RSA-2048 to encrypt all victim’s files. Locked with such secure technology, these files can no longer be accessed. In order to open them, a private decryption key is required, however, it is held by the ransomware operators in their servers. As explained in the ransom note, the victim can purchase it for a specified price. For further instructions, the _readme.txt file suggests writing to the criminals via support@sysmail.ch or helpsupportmanager@airmail.cc email.

The ransom note also briefly mentions that the virus has modified all data formats, including pictures, databases, documents, videos, archives and other files stored on the computer. The note also insists that the victim must contact the criminals as soon as possible as this fates whether the victim gets a 50% discount on the decryption tool or not. As the ransom note suggests, the victim is eligible for the discount if one writes to the provided emails within 72 hours (3 days) after the initial infection timestamp. This would set the decryption price to $490; otherwise, the victim is asked to pay full price, which is $980. Of course, the attackers won’t accept any form of direct payment and demand paying the ransom via cryptocurrency to avoid getting tracked down.

The ransom note also suggests attaching one small encrypted file to the email. They promise to reply with a decrypted file version to encourage the computer user to pay up. However, this should not incite you to pay – according to cybersecurity experts and FBI, paying a ransom to cybercriminals doesn’t guarantee data recovery. Moreover, the whole idea of sending your money to scammers is wrongful because doing so simply helps the attackers to initiate more attacks, more malware development and recruit more team members.

Worse still, this ransomware is known to compromise already-infected systems with information-stealing Trojans such as VIDAR or AZORULT. These Trojans are capable of stealing your cryptocurrency wallets, account login credentials, browser-saved passwords and other sensitive information associated with your computer. Such information can be later used to blackmail you and swindle even more money from you.

Cybersecurity experts strongly recommend you to REFUSE TO PAY THE RANSOM.

If you have unknowingly downloaded this malware to your computer, the best thing to do now is take action to cleanse your computer system from all threats. To remove QQQW ransomware virus, we recommend booting your PC in Safe Mode with Networking as explained below the article. Then, run a full system scan with an up-to-date antivirus software. If you do not have one yet, or in case you’re dissatisfied with the one you have, our team recommend using INTEGO Antivirus. You can read its review here. Additionally, you may want to download RESTORO and check if any virus damage can be repaired.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

How ransomware-type viruses are distributed

Ransomware operators who are responsible for distribution of STOP/DJVU variants such as QQQW virus tend to hide the payload in fake pirated software versions. These can be downloaded directly from scam websites in a form of RAR or ZIP archives, or via torrents. Cybercriminals prey on computer users who are willing to install illegal software copies in order to bypass license fees; these computer users are easy targets as they often choose to ignore their security software warnings as well. Some of computer users infected with the said ransomware strain versions report downloading fake software activation tools (such as cracks or keygens) for these popular programs and as a result, got all of their files encrypted:

• VMware Workstation;
• Tenorshare 4ukey;
• Adobe Photoshop;
• Cubase;
• Opera browser;
• Corel Draw;
• Fifa 20;
• AutoCad;
• Adobe Illustrator;
• League of Legends;
• Internet Download Manager;
• KMSPico (illegal Windows activation tool).

Remember that illegal software versions provided by various rogue sites online often do not even contain the software you’re looking for – they are used as a bait to trick you into downloading malicious files. Moreover, by searching and downloading such copyright-protected content via unofficial sources, you infringe copyrights of legitimate software vendors, which is illegal by law. Remember that a legitimate software license almost always costs less than large ransom amounts demanded by the criminals. Make the right choice and look for software versions provided by their official developers or confirmed partner websites.

Moreover, ransomware operators have a tendency to spread their creations via malicious email attachments. For this reason, they craft up convincing email messages, often pretending to be someone they’re not – such as representatives of well-known companies, victim’s colleagues, or even government agencies. The email typically insists that the target must open attached file (which may be named as invoice, order summary, or another casual document). Unfortunately, after opening such file, the victim gets infected with the ransomware. Therefore, you should inspect every email you receive carefully and ask yourself questions such as “Was I expecting this message?,” “Does this email looks trustworthy?,” “Did I actually order anything from the said company?” or “Did I have any business with this sender lately?”. Even if the sender’s address seems legitimate, you should check whether it was spoofed. In general, we advise avoiding interactions with email attachments or included links if you feel at least slightly suspicious about it, or believe that you weren’t supposed to receive it at the given time at all.

Finally, we want to warn computer users turned into ransomware victims not to search for decryption tools with hassle – only rely on legitimate and reputable cybersecurity-related websites or blogs of official antivirus vendors, because if you start browsing rogue online sites offering 100% working decryption tools, you might end up with additional malware on your computer. For example, ransomware strain known as ZORAB used to be distributed in a form of fake STOP/DJVU decryption tool.

Ransomware modus operandi – what happened during the computer attack

QQQW ransomware virus was for sure created by advanced malware developers, and so its modus operandi shows it. In this section, we will explain the basic functionalities of it, and what it does during the attack.

This variant of STOP/DJVU malware and its algorithm is consistent with the previous versions originating from the same ransomware strain. It begins the attack in a form of executable that is typically named with 4 random characters, for instance, 5B7N.exe. The ransomware then downloads several additional executables, usually named as build.exe and build2.exe or build3.exe and equally displays a fake Windows update prompt for the victim (winupdate.exe process).

The ransomware connects to https[:]//api.2ip.ua/geo.json and saves fetched response into geo.json file. This file contains information about the compromised computer’s location, including its country code, country name, region, time zone, longitude and latitude and more. You can see an example of this file in the image below.

At the same time, the ransomware creates information.txt file (depicted below). This file summarises victim’s computer’s details, such as user name, computer name, operating system, screen resolution, timestamp, and other data such as hardware specifics, installed software names and the list of active processes. An example of this file is provided below.

The virus also takes a screenshot of victim’s desktop and sends collected data to its Command&Control server. What is interesting is that this ransomware ceases its operations if it detects that the compromised computer is based in one of the following countries: Russia, Tajikistan, Syria, Belarus, Ukraine, Uzbekistan, Armenia, Kazachstan, and Kyrgyzstan. Otherwise, it continues its operations and begins preparation for data encryption.

The ransomware attempts to connect to its Command&Control server with request for a unique encryption key and victim’s ID. If it fails to obtain an online encryption key, it decodes one hidden in itself (also known as offline encryption key) and uses it instead. An indicator of offline encryption type is t1 characters at the end of PersonalID.txt file; this file is used to store victim’s unique ID, while the encryption key along with Personal ID will be stored into bowsakkdestx.txt file. You can see examples of these files in the screenshot provided below.

You must also know that victim’s of offline encryption can hope to decrypt .qqqw files in the future; for more details, see the explanation below this article or in this guide.

The ransomware then begins scanning the infected computer, visiting each folder and encrypting files found in them. The virus encrypts files with Salsa20 algorithm before additionally securing the procedure with RSA-2048 key. During this procedure, the virus marks each file with additional extension. You can see a screenshot of affected data folder below.

The virus also equally drops _readme.txt note in every visited data folder.

The virus also demonstrates common ransomware behaviour as it deletes Volume Shadow Copies using Command Prompt task as shown below:

^{vssadmin.exe Delete Shadows /All /Quiet}

The ransomware also modifies Windows HOSTS File by adding a list of restricted websites that will be mapped to localhost IP. Once this is finished, the victim won’t be able to access any of the deny-listed domains. When trying to visit one of these domains, web browser will likely display DNS_PROBE_FINISHED_NXDOMAIN error notification.

Remove QQQW Ransomware Virus and Recover Your Files

Computer users who have fallen victims to this malware variant must not delay its removal any longer. To remove QQQW ransomware virus, we recommend booting your Windows PC in Safe Mode with Networking (see the guide provided below) and running your antivirus solution from there. In case you do not have AV protection, consider using one recommended by our team – INTEGO Antivirus. This AV has excellent malware detection rate and provides real-time protection against computer threats. For additional computer cleanse and repairing virus-damaged Windows OS files, consider an option to download RESTORO.

Additional recommendations following QQQW ransomware removal are listed below.

• Contact the nearest law enforcement agency mandated to handle cybersecurity-related incidents;
• Use data backups to restore encrypted files. Make sure you only connect your external data storage device AFTER ransomware removal;
• Read about possible ways to repair/decrypt files damaged by STOP/DJVU variants.
• Replace all your passwords that were used on the compromised computer.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.