Geek's Advice

SBPG ransomware encrypts victim’s files for a ransom

SBPG ransomware is a variant of the dangerous but widely known STOP/DJVU ransomware family. This malicious and highly disruptive malware often targets all files contained in any computer it infiltrates and automatically encrypts them i.e. make them unreadable/useless and afterwards, appends .sbpg extension to each of them respectively. E.g. a saved file called 1.jpg becomes 1.sbpg and same is applicable to all other files. While the cyber-attack is still ongoing, a note known as _readme.txt will be dropped all folders. The _readme.txt file contains a note from the cybercriminals informing the victim how to pay a certain ransom fee that will fetch them SBPG decryption tool.  

Those behind the cyber-attack will inform the victim that SBPG ransomware virus has encrypted their entire files as contained in the computer, and since they made use of a very strong encryption key, they won’t be able to have access to the files anymore. However, if they can meet up with their ransom demand, the file decryption tool would be made available to him. To facilitate communication between them, these emails: manager@mailtemp.ch and helpsupportmanager@airmail.cc would also be forwarded to the victim.  

Furthermore, they will notify their victim about certain payment conditions they must adhere to. For instance, they will point out that even though the ransom fee is $980 but they will be willing to accept a 50% discount which brings the ransom fee to $490, provided the victim would be fast enough to pay within 72 hours/3 days.  

The moment the victim indicates interest in paying the ransom fee, they would direct him to pay the cryptocurrency worth of the fee into a wallet address they would make available. They apparently use this medium as a precautionary measure to always remain anonymous and avoid being tracked by law enforcement agents. In order to convince the victim about their capability to restore the encrypted files, they may inform them to forward any random piece but such must not contain any information they could perceive as important to the victim.

Our policy as formulated by in-house cybersecurity experts is in tandem with FBI guidelines, and both recommend that victims SHOULD NOT PAY RANSOM, regardless of the situation. The reason for this stance is because there is no guarantee you will recover your encrypted files, even if you pay the stipulated ransom fee. Also, when victims pay ransom, they are only encouraging the cybercriminals to continue being a menace since they would find it profitable and would be spurred to even widen their net. 

In addition, the virus equally releases other Trojans like VIDAR among others that are known to steal information from the already compromised computer. Such vital information that would be under threat of being stolen include banking details, software account login details, cryptocurrency wallets, browsing history, passwords saved in your browser etc. and once they get hold of these sensitive details, the victim would be at risk of further blackmail.  

For those that are victims of STOP/DJVU variant already, you will need to urgently remove SBPG ransomware virus as soon as you can from your computer. You can make use of any strong and genuine antivirus to run a full scan on your computer. Our team recommends an exceptional one – INTEGO Antivirus. You can read more about it here. As an additional step, we suggest downloading RESTORO to repair virus damage on Windows OS files.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Ways through which ransomware are distributed

One of the most common ways through which STOP/DJVU ransomware variants (including SBPG virus) are spread is by downloading malicious torrents. Certain pirated software copies, especially counterfeit of some popular ones are often laced with malwares and uploaded in online torrents libraries. Most of the victims of cyber-attacks have reported visiting such illegal sites before their computer systems became compromised. Therefore, such platforms should be avoided at all costs, including those that claim to offer license activation tools or “cracks”. Indeed, there are countless software contents that cybercriminals reproduce for the purposes of spreading malware, but below are the most common ones:

• Cubase;
• Adobe Illustrator;
• VMware Workstation;
• Fifa 20;
• Opera browser;
• AutoCad;
• Tenorshare 4ukey;
• Corel Draw;
• KMSPico (illegal Windows activation tool);
• Adobe Photoshop;
• League of Legends;
• Internet Download Manager.

So far, it has become evident that visiting online torrents libraries is never a smart idea; therefore computer users should avoid them. We always advise individuals to obtain their software needs legitimately, either directly through the official sites of the original content producers or their authorized third party agents. Online torrents platforms may appear cheap on the face value but they’re mostly traps set by cybercriminals to catch unsuspecting victims. Also, when you source your software content needs legitimately, you will be encouraging the industry to grow and you won’t be at risk of possible lawsuits for using illegal pirated software copies. 

Aside online torrents, another prolific way cybercriminals distribute ransomware is through malicious email attachments. In this format, they often create believable messages and documents, particularly making use of PDF, XLS or DOCX. These ones are popular because they have features that enable JavaScript or other macro functions that make it easy for the payload to be downloaded and released on any computer system. 

The worrying part is that trying to figure out if a particular email is genuine or a malware-carrying content can be quite difficult. The reason is because cybercriminals have devised means of camouflaging their emails to appear genuine. They may pretend to be family, friend or colleague, or even front as emails originating from reputable corporations like FedEx, Amazon, or eBay and would attach compelling files that would be named Invoice, Order Summary or Tracking Details etc. Alternatively, they even decide to obfuscate the originating email address with the use of email spoofing techniques. Nevertheless, our stance still remains that emails shouldn’t be opened indiscriminately. If you’re not expecting an email or have any business whatsoever with a brand sending you one, then it may not be wise to open such email. 

If, as the case may be, you’re already a victim, it is still necessary that you should avoid any website that claim to have decryption solutions. Such does not exist at the moment and throwing caution to the wind because you’re already a victim can lead to further damage in two ways, namely;

• Fake STOP/DJVU decryptors can be used to spread other ransomware versions like ZORAB;
• Downloading such fake tools can lead to double encryption of your files.

Further details about malware infection

For those that may be wondering about the extent of damage that was done to their computer system during the SBPG ransomware attack, this section would provide more insight. Generally, the first thing malware does after infiltration is to set up build.exe or build2.exe as well as winupdate.exe (i.e. the algorithm that prompts fake Window screen). Then, it makes a connection with https[:]//api.2ip.ua/geo.json while the result would be saved in geo.json file. It will then commence the process of gathering every piece of information about the computer such as its geo-location, time zone, zip code, hardware features and software contents, as well as longitude and latitude. This set of information will be forwarded to their central server. 

Below image is an example of geo.json file.

Afterwards, the malware will compare the geolocation of the computer against their list comprising of encryption-exempted countries, they are; Ukraine, Russia, Belarus, Kyrgyzstan, Syria, Kazachstan, Armenia, Tajikistan and Uzbekistan. If the computer’s geo-location matches with any of these countries, it will instantly stop any further attempt at encryption. However, if otherwise, it will proceed by fetching online encryption key from their central server which would be combined with the victim’s ID and saved to bowsakkdestx.txt file and to PersonalID.txt file. 

Please check below to see how these files appear.

However, if the virus fails to get an online encryption ID, it will make use of an offline ID which would be uniform for all victims of that same virus variant. You can tell if an offline ID was used if t1 key characters appear at the end of the personal ID. The implication of using an offline ID is that it increases the chances of decrypting .sbpg files, going forward.  

More details about this is provided below this article. 

At this stage, the ransomware will commence full data encryption process by scanning all folders and encrypting them with Salsa20 before locking the encryption with RSA-2048 key. While this process is still ongoing, the virus will mark every file with more extensions.

The image below is an example of _readme.txt ransom note dropped in every folder.

Next thing the virus does is to make use of Command Prompt task in deleting all Volume Shadow Copies as shown here: vssadmin.exe Delete Shadows /All /Quiet.

Additionally, the virus gathers information about compromised system, such as infection timestamp, computer name, hardware details, active processes and installed software. Gathered information is saved to information.txt file and also transferred to criminals’ C&C server. You can see an example of this file below.

The virus then wraps it up by compiling a list of domains on Windows HOSTS file and saves them on the localhost IP. By blacklisting these domains, the victim won’t be able to have access to them anymore and when he tries, DNS_PROBE_FINISHED_NXDOMAIN error message may appear on the screen each time the victim tries to browse any address from the list. The purpose of blacklisting these particular sites is to prevent the victim from getting any help online. 

The virus would drop additional malware on the already compromised computer, particularly Trojans like VIDAR or AZORULT. 

Remove SBPG Ransomware Virus and Recover Your Files

The two basic things victims should do once they discover they’ve been infected by malware is to report the situation to local authorities in charge of handling such issues and also to remove SBPG ransomware virus immediately. The guide below will teach you how to safely and effectively make use of antivirus while setting up your computer appropriately. If you’re looking for a trustworthy antivirus to use, our team recommends INTEGO Antivirus. Additionally, you may want to try and download RESTORO, which comes in handy when trying to repair virus damage on Windows OS files.

Now that you’ve completed SBPG virus removal, it is time to follow through on these steps as recommended by our experts: 

• You should inform the appropriate local authorities in charge of handling cybercrime and related issues;
• Now is the time to put your backup devices to good use. However, you need to ensure there are no more traces of malware in your computer system before plugging any external storage device;
• Learn possible ways you can repair files damaged by STOP/DJVU versions;
• All passwords associated with the compromised computer should be changed as a matter of urgency.

Cybercriminals are still very much on the prowl, desperately looking for unsuspecting users to prey on. However, by following the recommendations as stipulated here, it would help in preventing most of these unsavory experiences. 

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.