Geek's Advice

STAX ransomware is a new variant from STOP/DJVU file-encrypting virus family

STAX ransomware is a malicious virus that encrypts files and has been noted as a nascent variant emanating from STOP/DJVU ransomware family. This rogue virus encrypts files on any computer it infiltrates. It also attaches .stax extension to random filenames e.g. a file originally named 1.jpg gets renamed to 1.jpg.stax and so on. It will simultaneously drop a ransom note called _readme.txt in all folders respectively. Contained in the note is a message from the cybercriminals directing the victim how to pay ransom in exchange for STAX decryption tool. 

The message will notify the victim that STAX ransomware virus has encrypted all vital data inclusive of pictures, documents, and databases etc. Therefore, since they used very strong encryption key, there is no way the victim can have access to them again unless they pay ransom. The cybercriminals also drops two email addresses for the victim to contact them with: manager@mailtemp.ch and helprestoremanager@airmail.cc.

Furthermore, the cybercriminals also specifies the ransom fee and the conditions attached to it. If the victim can pay within 72 hours i.e. 3 days, they will slash the ransom by 50%, which brings it down to $490 but once 72 hours elapses, the victim would have to pay the full ransom fee of $980.   

If the victim reaches out to them, the cybercriminals will impress it on the victim that they will never be able to retrieve their vital data unless they pay the equivalent of the ransom fee in cryptocurrency. They would also make available a wallet address for the payment. The basic reason for using cryptocurrency channel is to cover their tracks and protect their identity so that law enforcement agencies won’t be able to trace them. In order to convince the victim of their capability to restore the encrypted files, they may ask the victim to send any random file from the encrypted ones so they could provide a decryption sample. But they will also emphasize that the encrypted file portion must not contain vital information.

Our in-house cybersecurity experts generally advice victims to follow FBI’s guidelines as pertains to ransom payment and based on that, WE STRONGLY DISCOURAGE THE PAYMENT OF RANSOM in any kind. Aside various other reasons, it should be noted that there is no guarantee that the encrypted will be recovered, and worse still, paying ransom to cybercriminals can only motivate them to continue in their nefarious activities of creating more malware and also to have more funds to pay software developers and platforms for malware distribution. These cybercriminals extort millions of dollars through ransom annually from victims of malware attacks. It is also important to note that this virus is known to release other data stealing viruses such as VIDAR or AZORULT on the system, and they are capable of stealing your vital information such as banking details, software account login details, cryptocurrency wallets, passwords saved on your browser and browsing history information among others. Once such vital details get into the wrong hands, it can lead to even more problems like blackmails and stealing of money or other important resources. 

Once any computer user discovers that their system has become compromised due to infiltration of this STOP/DJVU virus variant, it is advised that they remove STAX ransomware virus from their system as soon as possible. 

Having reliable and up-to-date antivirus software activated in Safe Mode with Networking can be proactively effective in detecting and ridding your computer system of any malware infections. If you can get any strong and reliable antivirus, then go ahead and activate it on your system, otherwise it would be in your best interest to go for INTEGO Antivirus as recommended by our experts. In addition, it is advisable to download RESTORO to help in repairing damages done on your Windows operating system files due to virus infection. 

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Ransomware distribution channels and techniques you need to be wary of

On a general perspective, computer systems mostly become infected with variants of STOP/DJVU ransomware like STAX virus due to exposure during downloading of malicious torrents. These dangerous malwares are known to hide in unwholesome or pirated software. Therefore, such contents should be avoided at all costs because opening any of such like a fake key generator or crack can automatically trigger a malware attack. 

Virtually all victims that suffered a malware attack from this variant reported that the cybercriminals either made use of pirated license activation tools or composed deceptive cracks to deceive unsuspecting users. 

Such downloadable software contents are then uploaded to as many torrent platforms online as possible, they include; 

• Adobe Photoshop;
• Corel Draw;
• KMSPico (illegal Windows activation tool);
• AutoCad;
• Opera browser;
• Fifa 20;
• VMware Workstation;
• Cubase;
• Adobe Illustrator;
• League of Legends;
• Internet Download Manager;
• Tenorshare 4ukey.

If you are among those that expose themselves to such avoidable risks by trying to access software torrents online, it will be in your best interest to immediately desist from such dangerous acts. The developers of these malicious malwares are already lurking by, waiting to take advantage of free loaders and greedy people that would fall for their bait by trying to obtain copyrighted contents illegally and at no cost. It may interest you know that getting involved in such can potentially lead to criminal prosecution. Considering the ills associated with all these, we advise users to ensure they obtain their software products legitimately through the recommended official channels. Always remember that the fee you pay to buy software from the copyright owners is negligible relative to the humongous ransom you will eventually pay when you become a victim of ransomware, as well as the risk of having your sensitive data get into the wrong hands. 

Since ransomware is equally spread through email attachments, those behind it may figure out how to send more believable messages and attachments to fool their potential victims. PDF, XLS and DOCX are the documents they use most because they enable macro functions or JavaScript and other enhancements. 

Considering that the cybercriminals are desperate, they often try to front their emails as genuine messages being delivered to you from a company, business associates or transactions such as tracking details, invoice, order summary etc. Sometimes, they even go as far as using email spoofing techniques in manipulate their actual sender’s email address. In all these, you may have to rely on your intuition to decipher if it makes sense for a particular email to be sent to you but if you’re not expecting such email and it triggers a red flag in your brain, then you may as well desist from opening it.    

When people fall victim to STOP/DJVU ransomware, they often become rattled and would seek for any available solution but it’s advisable not to patronise any website that claims to have the capability/tools to retrieve your encrypted files because such does not exist. At the moment, the only effective STOP/DJVU tools available out there are the ones created by Emisisoft and DiskTuna. We also explained how victims can successfully make use of it here. Also note that cybercriminals often spread other variants of ransomware such as ZORAB by passing them off as STOP/DJVU decryptor, but don’t fall for it because they’re fake and any attempt to download it would only lead to further encryption of your file.

What happened to your computer while ransomware was there

For victims that are still searching for more details or the extent their computer were compromised following the STAX ransomware infection, this section may prove vital to your quest because it captures all the in-depth explanations about the virus. The initial thing the malware does is to set up series of build.exe or build2.exe, as well as winupdate.exe that opens to a fake Windows update screen.

The ransomware would then make a connection with https[:]//api.2ip.ua/geo.json and then transmit the response to a file called geo.json. Furthermore, it will extract information such as zip code, time zone, and the computer’s geolocation which it will forward to their server. Below is an image of how geo.json looks like.

Additionally, the malware collects information about compromised computer’s name, software installed, and hardware details and save them to information.txt file as shown below. This information will also be sent to offender’s server.

Also, the malware would analyse the extracted country code against a list of malware attack exception countries that, they are: Russian Federation, Uzbekistan, Syria, Armenia, Tajikistan, Ukraine, Kazachstan, Kyrgyzstan, and Belarus. If it happens that the victim is from any of the listed countries, it will immediately abort the mission. 

However, if it scales the geolocation phase, the malware will commence the extraction of online encryption key from their server and would compile it with victim’s ID, and stores them in bowsakkdestx.txt file as well as the PersonalID.txt file. Examples are shown below.

The ransomware always makes use of offline encryption ID whenever it can’t get the online version and they are uniform to all victims of that particular virus variant. You can detect if an offline was used if t1 characters appear at the end of the victim’s personal ID. The good news is that you can hope to decrypt .stax files in the future. Check this tutorial for more details.

It will now commence data encryption by scanning every folder using Salsa20, then marks each file with unique extensions before using RSA-2048 to lock the encryption key. Afterwards, it will delete Volume Shadow Copies using vssadmin.exe Delete Shadows /All /Quiet.

While scanning through victim’s computer folders, the virus also drops _readme.txt ransom note that explains cybercriminals’ intentions. You can see a screenshot of this note below.

Lastly, the virus inputs certain domains to HOSTS file before classifying them to a localhost IP which effectively bars the victim from having access to some sites. DNS_PROBE-_FINISHED_NXDOMAIN error message may appear on the screen whenever attempt is made to browse the blocked websites. The aim is to ensure that victims do not get help online.

And the last step that this virus takes to cause even more damage to the victim is dropping additional malware, such as aforementioned VIDAR or AZORULT Trojans.

Remove STAX Ransomware Virus and Recover Your Files

Once again, it is very important to remove STAX ransomware virus ASAP once you discover it. To begin the process, you have to restart your computer through Safe Mode with Networking (please make use of the guide below). These steps, along with a strong antivirus will enable you to remove ransomware completely. 

INTEGO Antivirus is recommendable because we can vouch for its effectiveness, and you can also download RESTORO to repair damaged Windows OS files. Once you’ve successfully completed STAX ransomware virus removal, please endeavour to do the following: 

• Get in touch with the relevant law enforcement agency in your vicinity and inform them.
• Now you’re sure your computer is 100% malware free, you can make use of data backup to restore your files.
• Change all passwords associated with the computer system.
• Learn how to repair/decrypt files that were infected with STOP/DJVU variants.

The use of recommended antivirus can’t be overemphasized because it is crucial if you must get the entire process right. Based on that, you can follow the instructions below for optimal result!

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.