Geek's Advice

UDLA ransomware attacks computers to encrypt all files in them

UDLA ransomware is a newly discovered malicious and file-encrypting virus that belongs to the notorious STOP/DJVU ransomware group. This virus attacks computers by encrypting files contained in any computer it infects and also appends .udla extension to all file names. To explain it better, a file originally known as 1.jpg will automatically become 1.jpg.udla and the same format will be applied to every other file. During the attack, some ransom notes known as _readme.txt will also be dropped in all the folders. Contained in the ransom notes are notifications informing the victim about the cyberattack and why cybercriminals demand paying a ransom in exchange for UDLA decryption tool.

As written in the ransom notes, the cybercriminals will claim that UDLA ransomware was successful in encrypting the victim’s files, including their important documents, pictures and every other data that may be useful to them. Also, since they made use of a very unique and strong key, the victim would have no other choice than to comply with their ransom demands. They would equally drop two email addresses (support@sysmail.ch and supportsys@airmail.cc) while suggesting that the victim should reach out to any of them.

In addition to that, they would also list decryption service prices and conditions of payment attached to it. They will state that the amount payable by the victim would depend on how fast they’re able to meet up with payment. For instance, they would only be required to pay 50% of the ransom fee, which is $490, provided they can do so within 72 hours/3 days of being notified. However, if for any reason they fail to do so within that stated period, then only the full payment of $980 would be acceptable by the cybercriminals.

In a situation where the victim decides to reach out to the cybercriminals using the emails provided by them, more information regarding the payment specifics would be given to the victim. The cybercriminals would state that payment can only be made by buying cryptocurrency worth the ransom fee and also sending it across to them via a wallet address. The apparent reason why they insist that payment must be made through cryptocurrency is cover their tracks and prevent possible arrest by law enforcement agencies. They may also suggest that excerpts of the encrypted files be sent to them for test decryption as a way of proving their capability but will also warn that such excerpts must not contain texts they could perceive as important to the victim.

Our cybersecurity experts advise that victims should only do what FBI guidelines recommend, and it clearly states that RANSOM MUST NOT BE PAID no matter the pressure. Some of the reasons why ransom payment is strongly discouraged are stated below:

• There is no guarantee of retrieving your data even after paying the ransom.
• It encourages cybercriminals to continue attacking more people.
• More funds in their possession would enable them to speed up their operations and extent of them.
• The law of certain countries states that paying ransom in any guise is illegal.

Victims should be wary because the virus is known for dropping other Trojans that steal information such as VIDAR and AZORULT on the already infected computer. These Trojans can covertly extract sensitive personal information like banking details, cryptocurrency wallets, software login credentials, passwords etc. which they may eventually use to perpetrate further crimes like blackmail and theft.

Individuals whose computers were infected with any of the STOP/DJVU variants, including the one under review, should endeavor to remove UDLA ransomware virus as quickly as possible to limit possible damages. The recommended way of doing this is to boot the infected system through the Safe Mode with Networking option before scanning it with any genuine antivirus software. For optimal result, we strongly advise that only GENUINE security software solutions should be used. Our team also strongly recommends downloading RESTORO which can be used to identify and repair damaged Windows OS files automatically.

Ransomware Summary

REPAIR VIRUS DAMAGE

Ransomware distribution techniques used by cybercriminals

The most common way STOP/DJVU ransomware variants including UDLA virus are spread is through download of software contents on malicious online torrents. Cybercriminals usually embed malware on pirated software copies which they upload on such dangerous platforms and wait for unsuspecting users to download them. Based on that, the download and use of key generators and “cracks” is strongly discouraged because they can easily trigger severe ransomware attack. Some of the typical pirated software contents often used by cybercriminals in spreading malware are listed below:

• Adobe Illustrator;
• Adobe Photoshop;
• AutoCad;
• Cubase;
• Corel Draw;
• VMware Workstation;
• Tenorshare 4ukey;
• Opera browser;
• League of Legends;
• Internet Download Manager;
• KMSPico (illegal Windows activation tool).

Those that usually visit online torrents platforms for their software needs are hereby warned to desist from doing so to avoid becoming a victim of ransomware. Also remember that such unwholesome act is illegal and punishable by law. You’re better off paying the requisite fees attached to such software contents by their original content developers and the good thing is that it’s always insignificant when compared to the outrageous ransom fees cybercriminals demand from their victims. When you source for software copies through authorized channels, you will not only be helping the industry to grow but will also be protecting your files and sensitive data.

Another prolific method used by cybercriminals in spreading malware is through malicious email attachments. In this method, they would make use of files like DOCX, PDF, or XLS in composing highly convincing messages. Also, the crooks prefer these files because they allow macro functions and JavaScript that can be used in embedding payloads from external sources as well as triggering them in random computers.

The major challenge is how to decipher a genuine email from malware carrying ones sent by cybercriminals. Why it has become difficult is because cybercriminals now impersonate other people and brands and mirror their own email to appear “typical” and complete with inciting tags like Tracking Details, Invoice, or Order Summary. Alternatively, they may even decide to use email spoofing techniques in hiding the actual sender’s address. Regardless of the method they may use, it is crucial to always be proactive and avoid opening emails indiscriminately.

For those that unfortunately became victims of STOP/DJVU ransomware, you’re advised to shun certain dubious websites that claim to be decryption solution providers because such does not exist. So far, only the duo of Emsisoft and DiskTuna has tools that are proven to be effective in decrypting/repairing STOP/DJVU ransomware encrypted files. Also, do not forget that cybercriminals usually spread other ransomware versions like ZORAB through fake decryptors. Trying to download such fake decryptors can also lead to double-file encryption.

Further Information about the Virus

For those that may want to know the extent to which their computer was affected during UDLA ransomware attack, this section may prove helpful as it dwells more on the technical aspect of the virus. The first thing the malware usually does is to set up build.exe or build2.exe executables as well as winupdate.exe (the prompt that brings up a simulated Windows update screen). It will then connect to https[:]//api.2ip.ua/geo.json and would save the result in geo.json file. At this point, the malware has gathered every important detail about the computer under attack, such as the computer’s geolocation, time zone, zip code, latitude, and longitude. Shown in the image below is the geo.json file.

Other relevant details like installed software list and hardware details would be processed into information.txt.

The virus will now scan the computer’s country code against a list of countries they designated as protected from a ransomware attack. The countries are Russia, Belarus, Syria, Armenia, Tajikistan, Ukraine, Kazachstan, Kyrgyzstan, and Uzbekistan. If it finds out that the computer is domiciled in any of these countries, it would immediately abort its mission. But if it scales through the geolocation test, the ransomware will now extract the online encryption key and save it along with the victim’s ID into the bowsakkdestx.txt file. The ID will also be separately saved to another file called PersonalID.txt. Examples of these files are shown below.

In situations whereby the virus can’t retrieve an online encryption key from their C&C, it will switch its mode and use a hardcoded offline key to operate autonomously. You can inspect whether an offline key was used once there is t1 character appended to the victim’s personal ID situated in the C:\SystemID\PersonalID.txt file. What it means is that you could decrypt .udla files someday, as explained in this linked guide.

The ransomware will now commence full data encryption by scanning each folder and encrypting it with Salsa20 before using the RSA-2048 code in locking the encryption key. While this is going on, the virus will also mark files with an extra extension.

The screenshot below demonstrates contents of the _readme.txt ransom note that is typically left in various data folders on the compromised computer.

In completing the entire process, the virus will add certain domains to the Windows HOSTS file and map them to the localhost IP. This move will practically prevent the victim from having access to those sites, and any attempt to browse them will bring up the DNS_PROBE_FINISHED_NXDOMAIN error message. Their aim is to prevent the victim from getting help from online support forums.

Remove UDLA Ransomware Virus and Recover Lost Files

Victims of ransomware attacks should as a matter of urgency remove UDLA ransomware virus or any other variant as the case may be. As stated earlier, the best way is to set up your computer in Safe Mode with Networking before applying a strong and reliable antivirus. It is very important to only make use of genuine antivirus. You should consider downloading RESTORO (secure link) in identifying and restoring damaged Windows system files.

Now, if you’ve successfully finished UDLA ransomware virus removal, it is about time to take the following steps:

• Report to the relevant government agencies responsible for handling such cases.
• Use any available backup device in restoring lost data but ensure the virus is completely removed from the infected computer before doing so.
• Research on possible ways STOP/DJVU encrypted files could be decrypted or repaired.
• Immediately change all passwords associated with the compromised computer.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.