Remove TISC Ransomware Virus (DECRYPT .tisc FILES)

TISC ransomware aims to encrypt all of your files for a ransom

TISC ransomware is a variant of STOP/DJVU file-encrypting computer virus family. It uses Salsa20 algorithm to make victim’s files inaccessible. Once encrypted, each file gets appended with additional .tisc file extension to make the file distinguishable. For example, file originally called 1.jpg appears as 1.jpg.tisc after the cyber attack. The virus also drops ransom-demanding notes called _readme.txt in every folder including desktop. This text file contains a message from cybercriminals behind the malware who suggest that the only way to get TISC decryption tool and key is to pay a ransom for them. The attackers also present pricing of the tools – it costs $490 if the victim contacts the attackers within 72 hours or $980 later. The payment must be made in cryptocurrency such as Bitcoin to preserve the attackers’ identity. This virus’ variant is known to provide new contact email unseen in previous STOP/DJVU versions – supporthelp@airmail.cc and already known one – manager@mailtemp.ch.

TISC ransomware virus is used solely to extort computer users by taking their files hostage and demanding to pay a ransom. The algorithm of this malicious software is programmed to encrypt the very first 150 KB of each file, which makes the attack process speedy yet enough to make files inaccessible to the original owner. The encryption algorithm is known to be military-grade and is typically used to secure information between two endpoints so that only the one who has the decryption key could decrypt and view it. The cybercriminals who operate this ransomware suggest purchasing this key along with decryption software for a specified price. In other words, they turn victim’s files into hostages and try to extort the victim financially.

However, if your files were encrypted, there are some methods you can try to restore or repair at least part of them. The number one method is to use a data backup if you had one created prior to the attack (the ransomware must be removed from the system before attempting to do this). Additionally, you can use the guide given below this article which explains how to decrypt or repair files locked by STOP/DJVU versions. Speaking of file repair, Media_Repair by DiskTuna can help you to repair specific file formats with small data portion at the beginning of the file missing. you can read more on how to do it here.

The ransom note left by TISC ransomware is named _readme.txt and is identical in each folder where it was placed by the virus. It suggests that the victim can return all of the files, although “the only method of recovering files is to purchase decrypt tool and unique key.” Speaking of guarantees, the note suggests sending one encrypted file to the attackers via provided email addresses. They promise to provide a decrypted file version in their reply. However, the note specifies that this file should not contain any valuable information (cybercriminals are afraid that recovering valuable information will refrain the victim from paying the ransom altogether).

The note also explains that the full decryption price is $980 although if the victim writes to the attackers within the first 72 hours, they will provide a 50% discount and the price will be $490. When contacted via email, the attackers will respond with information on how to purchase cryptocurrency worth the amount and their wallet address which should be used to make the transaction. The simple reason why the victim can’t pay directly via bank is because this could lead to attackers’ arrest, so they prefer an untraceable payment method instead.

Cybersecurity experts from Geek’s Advice team do not recommend paying a ransom to cybercriminals. The same is stated by the official FBI recommendations. Here are some reasons why you should pay up:

• Paying a ransom does not guarantee successful data recovery. The criminals can disappear and stop responding to your emails the minute you make the transaction to their wallet address;
• The amount of money ransomware operators collect allows them to target more victims and lures other people to sign for Ransomware-as-a-Service even without much technical knowledge. According to reports, people behind such malware attacks collect millions of US Dollars each year. If people would stop paying ransoms, the ransomware system would run out of “fuel” that keeps it running;
• STOP/DJVU virus variants such as TISC often drop additional malware on the compromised host – AZORULT Trojan. It is capable of collecting sensitive information that can lead to further blackmail and more damage.

REPAIR VIRUS DAMAGE

Ransomware activities on your computer explained

TISC ransomware virus mostly reaches the victim’s computer in a form of a malicious torrent download, often a software crack. Once launched, it opens several build.exe executables (build2.exe, build3.exe) for initial preparations. It then performs a check for working Internet connection and if successful, connects to its Command&Control server and gets a unique online encryption key for the victim, which it saves to a bowsakkdestx.txt file on the computer. The virus also assigns a personal ID to the victim and saves it to the aforementioned file and PersonalID.txt file as well. In case the virus cannot reach its C&C server, it uses a hardcoded offline encryption key instead. A sign indicating that offline encryption key was used is t1 characters at the end of the personal ID assigned to the victim.

Once the encryption key is determined, the virus starts the data encryption phase. It is programmed to target a list of file extensions with some exceptions to keep the operating system intact. During this phase, the ransomware makes files inaccessible, marks them with additional extensions and leaves ransom notes in each visited directory. At the same time, the virus showcases a fake Windows update prompt (winupdate.exe), which is designed to trick the victim into thinking that a sudden system slowdown is caused by ongoing OS updates.

Malicious programs of such kind typically ensure that Volume Shadow Copies are removed from the system by running a Command Line task:

^{vssadmin.exe Delete Shadows /All /Quiet}

This helps to prevent the victim from restoring part of the data using System Restore points. Additionally, the described ransomware collects some information (such as computer name, user name, operating system version, keyboard language, hardware specifics, processes and software installed) in information.txt file. The ransomware connects to “https[:]//api.2ip.ua/geo.json” which returns IP, country code, city, longitude, latitude, zip code and time zone of the compromised system. The ransomware compares country code with codes from the exception list and if match is found, terminates its processes.

Some STOP/DJVU versions also modify Windows HOSTS file by adding a list of domains to block for the victim. The virus maps them to localhost IP to cause a DNS problem. Therefore, if the victim tries to reach one of the blocked domains either directly or access them via search engine results, DNS_PROBE_FINISHED_NXDOMAIN error will come up. It was noticed that the virus blocks various cybersecurity and computer help related pages, including microsoft.com and others. We believe that the virus’ developers do not want the victim to find help online or find recommendations on how to respond or report the attack.

The final and very dangerous thing this ransomware does is dropping an information stealer called AZORULT on the infected system. This threat isn’t mentioned in the ransom note, although it is capable of collecting data and allows the attacker to perform various activities on the target system via remote access feature:

• Download various computer malware and running it;
• Take various login credentials, such as those of Telegram, Steam and other programs and send them to criminals;
• View or delete files on the victim’s computer;
• Steal cryptocurrency wallets and their contents;
• Steal browser-saved passwords, browser cookies, browsing history and more.

The best thing to do after being infected with such computer virus is to take action to get rid of it as soon as possible. For this task, we strongly recommend using a professional security software which can not only remove the threat, but also protect you from similar attacks in the future. That said, we recommend using INTEGO Antivirus which is a VB100 certified software. Additionally, you may want to download RESTORO to repair virus damage on Windows OS files.

Ransomware Summary

REPAIR VIRUS DAMAGE

How ransomware-type viruses are distributed

In order to prevent ransomware infections in the future, it is essential to understand how such viruses are distributed by cybercriminals. The most common attack methods are based on exploit kits, malicious email attachments and links, malicious torrent downloads and web attacks.

The primary method used to spread STOP/DJVU versions such as TISC ransomware virus is malicious torrent downloads. Almost every victim of this ransomware strain who contacted us reported downloading it along a software crack for various popular software versions, such as:

• Adobe Photoshop;
• Corel Draw;
• Tenorshare 4ukey;
• League of Legends;
• Cubase;
• Adobe Illustrator;
• Windows activation tools such as KMSPico.

Cybercriminals prey on computer users who try to get paid software versions for free using peer-to-peer file sharing clients. These programs do not check for malware, however, such computer users are often willing to ignore their cybersecurity software warnings on such downloads as well. In most cases, users believe that any crack downloaded from the Internet gets marked as dangerous, although most of the time it actually is. Even if you do not notice suspicious signs after installing the software, you might already be infected, for instance, with cryptocurrency mining software, Trojan or a ransomware with a idle mode that is set to be launched after a specific period of time.

If you wish to get premium software version, please visit its official developer’s website and get a legitimate copy from there. We should support software creators rather than greedy criminals. Besides, the cost of a genuine software copy always costs less than insane ransom amounts demanded by crooks.

Malicious email attachments and links are often used by criminals who send out similar messages to thousands of potential victims. They obtain email addresses from various data leak databases in the dark web. It is common for them to pretend to be someone from a reputable company or even victim’s colleague. The majority of such emails urge the victim to open the attached document and reply as soon as possible. The attachment is usually named as a regular document, for instance, invoice, payment details, order summary, waybill, parcel tracking details and similar. Cybercriminals can even spoof the sender’s email address to make it appear as something else for the victim.

It can be hard to identify a malicious email message nowadays as scammers get more and more creative; that said, we strongly recommend you to avoid opening attachments or included links if you did not expect to receive an email from the sender. Do not let your curiosity to trick you into opening something that can severely harm your computer. Besides, if you sense that something is wrong with the email, for example, you notice a suspicious style of writing, grammar errors, unprofessional logos, weird greeting line or the message urges you to interact with attached contents, better avoid clicking on links or attachments.

Final infection vector we’d like to discuss is fake STOP/DJVU decryption tools, so be very careful. If you’re looking for a decryption tool, first check if such one exists. Such tools are usually widely talked about in legitimate and well-known Internet sources such as cybersecurity news sites, antivirus vendor’s sites and similar. Do not risk downloading such files from rogue websites. Cybersecurity experts report that ZORAB ransomware operators are using fake STOP/DJVU decryption tools to spread their own virus. This could end in double-encryption of your files.

Remove TISC Ransomware Virus and Decrypt Your Files

If you have become a victim of a ransomware attack, you should not hesitate and eliminate the malware from your computer system as soon as you can. Our team recommends using a robust antivirus with real-time protection for this matter – INTEGO Antivirus. You should follow the steps provided in the guide below to run it in Safe Mode with Networking to eliminate the malware safely. Additionally, you may want to download RESTORO which can repair virus damage caused on Windows OS files.

Once TISC ransomware virus removal is done, read these tips on how to respond to the cyber attack:

• Inform your local authorities about an Internet crime case. You can find some references below this guide.
• Use data backup to restore the majority of your files.
• Follow the given steps to decrypt or repair files affected by STOP/DJVU versions.
• We also recommend changing your passwords, especially for websites that you save login credentials for in your browser.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.