Geek's Advice

QSCX ransomware is a new variant of STOP/DJVU computer virus

QSCX ransomware is a computer virus originating from STOP/DJVU malware family. This threat is designed to encrypt all files on victim’s computer using RSA Salsa20 algorithm. During the attack, the virus appends .qscx extension to each filename to make affected files distinguishable. As a result, these files will have double file extensions. To illustrate, file previously named 1.jpg becomes 1.qscx. The said ransomware is made to drop ransom notes called _readme.txt in every folder affected by the encryption procedure. The note contains a message from the criminals who explain that all personal data stored on the computer has been encrypted with the strongest algorithm. In addition, the attackers suggest that purchasing QSXC decryption tool from them is the only way to recover these files. The crooks demand paying a ransom to them and the price of it depends on how quickly the victim contacts them. If one writes to the provided emails and completes the virtual transaction within 3 days, the ransom price will be $490. Otherwise, the criminals demand $980 in cryptocurrency. The sole contact form left by the ransomware operators are two emails: helpteam@mail.ch and helpmanager@airmail.cc.

MPPQ ransomware creators aim to take victim’s files hostage by encrypting them with RSA + Salsa20, then try to extort the victim. They demand transferring a specified sum of money to their cryptocurrency wallet. The reason why the attackers demand money in cryptocurrency is because this keeps them anonymous. The further details and the virtual wallet address isn’t given in the ransom note as the attackers provide such information only to victims who write to them via email.

The ransom note dropped by the virus is named _readme.txt. It begins with a reassurance line “ATTENTION! Don’t worry, you can return all your files!” followed by explanation that all files have been encrypted with strongest encryption and unique key. The note then goes on to explain that the victim needs to purchase special QSCX decryption software from the criminals for $490 in 3 days or $980 later. In order to persuade the victim to transfer the money, the crooks suggest decrypting one file for free. In other words, they suggest something called ‘test decryption’ to prove the victim that such tool for data decryption actually exists and is capable of restoring victim’s files back to normal. However, there are certain conditions that must be met – the victim can only send one file for decryption, it must be small in size and contain no valuable information. It is obvious why the attackers dictate such conditions – they clearly do not want victim to lose interest in paying the full ransom.

Speaking of ransoms, we do not recommend paying them to cybercriminals. Same is said by cybersecurity experts worldwide and confirmed by FBI to be a bad practice. There are numerous reasons why it isn’t worth paying up:

• Paying the required sum of money to criminals does not automatically guarantee you will recover your files. The attackers might provide you with faulty decryption tool or vanish into the thin air.
• Paying the ransom, just like asking for it, can be illegal in your country.
• Do not support the cybercrime industry by paying more money to criminals. The amount of ransoms collected each year is believed to be one of the factors that lures other people to join ransomware gangs and expand the malevolent operations and their reach.
• STOP/DJVU ransomware variants such as QSCX virus, are known to run AZORULT Trojan on the compromised hosts. This Trojan is designed to silently steal sensitive information from your computer and transfer it to cybercriminals. Therefore, we do not recommend following such sneaky attackers’ commands as they might use collected information to extort you later.

Ransomware damage: what has been done to your computer?

QSCX ransomware runs a fake winupdate.exe process (launches a fake Windows update prompt) to trick the victim into thinking that a sudden system slowdown is due to an ongoing OS update and not some kind of a problem. The second thing this virus does is it runs some CMD commands to delete Volume Shadow Copies from the computer. This will prevent the victim from restoring encrypted files using System Restore points. Next, the virus starts system scan during which it searches for files with extensions that match ones from its target list. Once found, the virus encrypts the first 150KB of a file using RSA+Salsa20 algorithms. Consequently, such file becomes impossible to open, read, edit. The virus does the same thing for all files in folders and before leaving for another directory, it drops _readme.txt file with a pre-composed text. As mentioned, the virus modifies only the first 150 KB of file, therefore some file formats can be easily restored with minimal file loss. More on that in this guide.

Final modification to system files that this ransomware does is altering Windows HOSTS file. The virus adds a list of domains to restrict on the compromised host. As a consequence, the victim won’t be able to connect to these websites and will run into DNS_PROBE_FINISHED_NXDOMAIN error when trying to connect to specific website directly or, for example, via search engine results. The list of domains added seem to have one trait of similarity – tehy all publish articles about computers, cybersecurity and how-to guides. Therefore, it seems that ransomware authors try to prevent the victim from finding relevant ransomware-attack related information online as well as confuse the victim even more.

As mentioned previously, variants from STOP/DJVU ransomware strain tend to drop AZORULT malware on the system. To explain, it is a well-known Remote Access Trojan (RAT) that can be used by criminals to remotely view or delete files in victim’s PC, drop malware on it or download files from victim’s computer to criminals’ servers and more. The malware has other functionalities, such as stealing private information: saved browser passwords, browsing history, cookies, Steam and Telegram login credentials, cryptocurrency wallets and more. Chance to get their hands on such information allows attackers to carry out various phishing and blackmailing attacks, say, via email spam.

We strongly recommend you to remove QSCX ransomware virus and additional malware using free guide provided below. Our team recommends using a robust anti-malware of your choice as well as downloading RESTORO to repair virus damage caused by this computer menace.

Ransomware Summary

How ransomware-type threats are distributed online

Computer viruses that fall into ransomware category are mostly distributed via illegal online downloads, injected into malicious ad networks, await on compromised websites or travel in a form of email attachment. STOP/DJVU ransomware variants, including QSCX ransomware are known to await in illegal online downloads, mostly torrent-type software or game cracks. Some victims have also reported finding variants of this ransomware in KMSPico virus variants. Therefore, it is apparent that the developers of this ransomware target people who are trying to download paid software products for free. What makes this distribution technique even more successful is that people who are looking for illegal software cracks also tend to ignore their security software warnings about potential malware inside of them, thinking that these alerts are simply false positives.

We recommend you to avoid going to shady online websites looking for software cracks or 100% free downloads of software that is known to be a paid product. The only way to get such software legally and safely is going to its official developer’s website or one that is confirmed to be a trusted partner/distributor of the said software.

In case you have recently downloaded such torrents via peer-to-peer download agents, you should scan your PC immediately, even if it seems that nothing happened. Files like this are often used to drop silent malware on victim’s computer, such as cryptocurrency miners, remote access Trojans or password-stealers. Such computer threats can do various illegal tasks without even catching your attention.

Cybercriminals’ choice for virus’ distribution often involves usage of malicious email spam. The crooks compose convincing messages claiming to be from well-known company, colleague or someone you possibly know. Such messages urge to open attached document to review missing payment information, invoice or parcel delivery details. The number of topics and ideas that criminals use to deceive the victim is endless. Therefore, we strongly recommend you to avoid opening such attachments and inspect the email very carefully. To be on the safe side, we do not recommend opening such attachments if you did not expect to receive such email. Secondly, if you got an email from someone claiming to work at a well-known company, you can find its contact details on any search engine and call them to get reassurance whether the email was legit or not. More importantly, do not believe that the sender is someone who he/she claims to be – the attackers actively use email spoofing techniques to conceal the actual sender’s email. You can read more about email spoofing here.

Quick tip: avoid opening email attachments if the email’s images are blocked, the letter is marked as a possible spam, or if a sender specifically asks to be informed when you read the message. These methods are frequently used to signal the attacker’s servers about your interaction with the email so that more spam would be sent towards your email inbox. To avoid opening a potentially malicious email, we recommend only interacting with emails that you expected to receive.

Ransomware victims often get desperate trying to search the world wide web for data decryption tools, hoping to find it on a random website online. However, we can assure you that if an official decryption tool appears, it will be covered by largest news sites worldwide. There is no need to start checking shady websites on 6th search engine results’ page as this most likely will lead you to dangerous websites. The point we’re trying to make is that due to popularity of STOP/DJVU variants, other ransomware strains decided to upload fake STOP/DJVU decryption tools that hide additional ransomware inside of them. One of threats known to be distributed in such way is ZORAB ransomware.

Remove QSCX ransomware virus and decrypt/repair your data

Remove QSCX ransomware virus from your PC by following expert-prepared guidelines. We provide these guidelines down below. Make sure you read given instructions carefully and ensure that you do not miss any of the steps provided. Do not hesitate to drop your questions in the comments section. Finally, we advise downloading RESTORO to scan for malware damage and repair it on your operating system files.

After thorough QSCX virus removal, we strongly suggest completing the following tasks:

• Inform a local authority about a case of a ransomware attack. You can find some references below this article.
• Try to search for data backups and recover at least part of your files using them.
• Learn how to decrypt or repair files affected by STOP/DJVU versions.
• Change your login credentials for websites saved in your browser’s memory.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.