Geek's Advice

Description of RGUY ransomware which is designed to encrypt files on computers worldwide

RGUY ransomware is a nascent malicious file-encrypting virus that just emerged from the infamous STOP/DJVU ransomware group. This new virus also encrypts files saved in any computer it infects while equally appending .rguy extension to each of them respectively. For instance, a file that hitherto saved as 1.jpg will become 1.jpg.rguy afterward and same will apply on all others. While the attack is still ongoing, _readme.txt ransom notes will be dropped in all the folders. Contained in the ransom notes are messages sent by the cybercriminals notifying the victim about what happened and the need to pay ransom to enable them receive RGUY decryption tool.

The cybercriminals would claim that RGUY ransom-demanding virus has successfully encrypted all the files contained in the computer, inclusive of pictures, documents and every other data. Furthermore, since they made use of a very strong and unique encryption key, therefore the victim has no other choice than to comply with their ransom demand. Also included in the ransom notes would be two email addresses, namely: support@sysmail.ch and supportsys@airmail.cc which the victim is expected to reply them with, as well as the decryption service prices. They will state that the amount payable by the victim will depend on how soon they are able to comply. For instance, if the victim is able to pay within 3 days of being notified, he would be mandated to pay 50% of the ransom fee or $490 but once it exceeds the stipulated timeframe, only the full amount must be paid i.e. $980.

However, if the victim decides to contact the cybercriminals, they would make it clear that payment can only be made through cyptocurrency, whereby they would buy the equivalent amount of the ransom fee in cryptocurrency and also make a transaction to a wallet address provided by them. The apparent reason why they use this payment platform is to remain elusive to law enforcement agencies. To show their expertise and also influence the victim, they may request that a small part of the encrypted files be sent to be them for test decryption, but will add a caveat that such part must contain any information that could be perceived as important to the victim.

Nevertheless, our in-house cybersecurity decision-makers warn that victims should always follow the recommendations outlined by the FBI on matters relating to ransom payment, and it states that ransom SHOULD NOT BE PAID, no matter the pressure. Some of the reasons for such stand is listed below for your consideration:

• There is no guarantee you will recover your files even after paying the ransom.
• By paying the ransom, you’re encouraging them to continue in their nefarious activities since they would find it profitable.
• More funds in their hands will only enable them to increase their capacity and continue being a threat to more people.

It is important to note that information-stealing Trojans like VIDAR and AZORULT are equally spread by the virus, and can be used in stealing vital personal information such as banking details, passwords, crypocurrency wallets, software account credentials etc. and these could lead to further problems like blackmailing.

For those whose computers were infected with any of the STOP/DJVU variants, the first important step to take will be to remove RGUY ransomware virus without any delay. This can be done effectively by setting up the infected system in Safe Mode with Networking before running any reputable antivirus software on it. However, it is very important to make use of only antivirus brands that have been certified to be genuine and effective if you want to achieve optimal result. Based on that, we recommend INTEGO Antivirus. You can also download RESTORO which can be used to repair affected Windows OS files.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Ransomware distribution methods to be wary of

The most common methods used by cybercriminals in spreading STOP/DJVU ransomware variants including RGUY virus is when unsuspecting users try to download software copies from online malicious torrent platforms. Cybercriminals usually embed malware on pirated software copies such as key generators and “cracks,” which they upload to such platforms in order to catch their victims. Several victims over the years became aware of virus infection on their computers after downloading particular pirated software contents, and the most common ones are listed below:

• Adobe Photoshop;
• Internet Download Manager;
• Tenorshare 4ukey;
• AutoCad;
• Opera browser;
• Corel Draw;
• VMware Workstation;
• Cubase;
• MatLab;
• Adobe Illustrator;
• League of Legends;
• Fifa 20;
• KMSPico (illegal Windows activation tool).

For those that usually visit such online torrents platforms, it would be in your best interest to stop doing so immediately. Aside from the fact that such download is illegal and a copyright infringement that is punishable by law, you’re also putting your computer and the files contained in it at serious risk. On the contrary, we recommend going to the official pages/platforms of the original software producers to obtain your software needs and also pay the requisite fees. Always have it in mind that whatever token you pay legitimately can never be compared to the outrageous ransom fees often demanded by cybercriminals. Another advantage is that you won’t be at risk of losing your important personal files.

Another method used by cybercriminals in spreading malware is through malicious email attachments. In this method, cybercriminals would compose believable and ordinary looking messages that would be accompanied with attachments crafted on formats such as XLS, PDF or DOCX. They prefer using these particular ones because they enable macro functions and JavaScript which can be used in transporting and triggering payload in diverse computers.

The problem here is that trying to decipher which email is genuine or sent by cybercriminals has become increasingly difficult in recent times. The reason is because these online rogues have devised means of impersonating as acquaintances or popular brands such as Amazon, eBay, UPS, FedEx and DHL among others. Worse still, they would make use of compelling titles like Invoice, Tracking Details or Order Summary etc. Alternatively, they may even decide to use email spoofing to completely obfuscate the sender’s address to confuse their target victims. Whichever method they use, you’re advised not to open emails indiscriminately in order not to be caught unawares.

Finally, victims of STOP/DJVU ransomware are better off staying away from dubious websites that claim to offer decryption solutions. Such claims are largely false because only DiskTuna and Emsisoft have proven to be capable of decrypting STOP/DJVU encrypted files. Here is a link to where you can learn more about them.

Further details concerning the infection

For those that may want to know what exactly happened to their computer during RGUY ransomware attack, this section will explain more. The first thing the virus does is to fetch build.exe or build2.exe as well as winupdate.exe (the prompt that shows fake update screen) from rogue online domains. The virus then connects to https[:]//api.2ip.ua/geo.json and also saves the response in geo.json file. This file typically contains geolocation-related data such as location details (IP address, country, city and zip code), time zone, latitude and longitude, and more. The image below shows samples of some geo.json files.

It will also drop another file that will contain installed software list, hardware details and active processes in information.txt.

Furthermore, the virus will make a comparison using the extracted country code against a list of encryption-exempted countries formed by them. The countries are Russia, Ukraine, Syria, Armenia, Tajikistan, Ukraine, Kazachstan, Kyrgyzstan, Uzbekistan and Belarus. In situations whereby the computer is located in any of the aforementioned countries, they would immediately abort their mission.
However, if it scales the geolocation test, the ransomware would fetch online encryption key from their server and would merge it with the victim’s ID before saving it in the bowsakkdestx.txt file and to the PersonalID.txt file. Shown below is example of these files.

However, if the virus fails to extract any online encryption key from their server, it will make use of a hardcoded offline key as an alternative. The difference between the two is that online ID is unique per victim and extremely difficult to decrypt while offline ID is uniform for all victims of the same variant and there is a high chance it can be decrypted. The presence of t1 characters appearing at the end of a personal ID is an indication that offline ID was used and thus improves the likelihood of decrypting .rguy files. More information about it is provided below.

At this point, the ransomware will commence full data encryption procedure by scanning every folder and encrypting them with Salsa20 before using RSA-2048 key to lock the encryption key. While this is still ongoing, more files will be marked with additional extensions.

You can check below for image of _readme.txt note that is usually left in all the folders.

To round up the entire process, the virus will add a number of domains to the Windows HOSTS file and also map them to the localhost IP which effectively prevents the victim from having access to them. Any attempt to browse them will bring up DNS_PROBE_FINISHED_NXDOMAIN error message. The reason for blacklisting them is to ensure the victim doesn’t get any help online.

Remove RGUY Ransomware Virus and Restore Your Files

Victims are supposed to remove RGUY ransomware virus without delay once they’re sure of their presence. Like we stated earlier, the recommended way to do so is by setting up the infected system in Safe Mode with Networking before applying a good antivirus such as INTEGO Antivirus. You should also consider downloading RESTORO to help in identifying and repairing Windows system files.

Now that RGUY ransomware virus removal is complete, the following steps should be taken:

• It is very important to report to relevant government agencies responsible for handling such issues.
• Make use of any available data backup drives to restore lost files.
• Learn possible ways files locked by STOP/DJVU ransomware variants could be repaired or decrypted.
• Immediately change all passwords that were used in the compromised computer.

In conclusion, always remember that taking proactive measures in order to avoid getting your computer system infected is always the best course of action to take.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.