Geek's Advice

WDLO ransomware uses encryption to lock your personal files

WDLO ransomware is a malicious computer virus designed to encrypt all files on the target system. It is the 430th version released from the STOP/DJVU malware gang which marks encrypted files with .wdlo extension. For example, a file originally called 1.jpg appears as 1.jpg.wdlo, 2.txt becomes 2.txt.wdlo after the PC attack. Now that all data on the system is encrypted, the virus leaves ransom-demanding notes named as _readme.txt. This note explains that cybercriminals want the victim to purchase WDLO file decryption tool for a specified amount of money in order to recover locked data.

The message in the _readme.txt note explains that all of victim’s files, including pictures, music, documents, videos and archives were encrypted with the “strongest” encryption algorithm and a unique key. After being encrypted, these files can no longer be opened, viewed or modified. This can be devastating for the computer not only because personal memories become corrupted, but also months or years of work or study materials. The cybercriminals then provide a solution – pay a ransom or the data will be lost forever. To open a channel of communication, the ransom note includes two email addresses that belong to cybercriminals – support@sysmail.ch and supportsys@airmail.cc.

The ransom note also explains how the pricing of the decryption tool works. If the victim contacts the attackers within 3 days (72 hours), the price of it will be reduced by 50% to $490, and if the victim hesitates to write for the cybercriminals any longer, the price will be set to $980. In both scenarios, the criminals will only accept the payment made via cryptocurrency, as such transactions helps to keep them anonymous (meaning that law enforcement agencies such as FBI won’t be able to trace down the attackers). The _readme.txt note also suggests that victims can send one encrypted file (one that doesn’t contain any valuable information) via email for test decryption. This way, they want to encourage the victims to pay up.

However, according to cybersecurity experts and the official FBI guidelines regarding ransomware attacks, you should NOT PAY THE RANSOM. Not only it doesn’t guarantee data recovery, but it also helps to fund further criminals’ operations. Moreover, paying a ransom might be forbidden in the area you live in; on top of that, keep in mind that STOP/DJVU variants like this virus tend to drag information-stealing malware such as AZORULT or VIDAR Trojan into the system. These are capable of stealing various banking information, browser-saved login credentials, in-app passwords, browsing history, cryptocurrency wallets and more. With their hands on such sensitive data, the attackers can continue to blackmail you further.

All things considered, we strongly recommend you to remove WDLO ransomware virus from your computer as soon as you can. The best way to do it is running an up-to-date antivirus or anti-malware solution after booting your PC in Safe Mode with Networking (as explained in the tutorial below the article). If you’re hesitant which antivirus to use, you can rely on one recommended by our team – INTEGO Antivirus. In addition, you may find it useful to download RESTORO and scan your PC with it. The full version of this software can repair virus damage on Windows OS files successfully.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Most common ransomware distribution strategies

The most common way that STOP/DJVU ransomware variants such as WDLO virus are distributed is via pirated software versions. Cybercriminals promote these via torrents or rogue websites offering 100% free full software versions allegedly including software cracks and keygens. Illegally distributed software versions work as a bait for potential victims, however, often times the download itself doesn’t include anything related to the advertised program at all. Instead, the setup file pushed to the victim activates the ransomware which encrypts all of victim’s files stored on the computer system. Our research shows that the majority of STOP/DJVU ransomware victims were infected with the said malware after downloading pirated versions of these popular programs:

• KMSPico (illegal Windows activation tool).
• Fifa 20;
• Microsoft Visio Pro;
• Tenorshare 4ukey;
• AutoCad;
• Opera browser;
• Cubase;
• Virtual DJ Pro;
• Microsoft Visio Pro;
• Corel Draw;
• Adobe Illustrator;
• League of Legends;
• VMware Workstation;
• Internet Download Manager;
• Adobe Photoshop;
• Various PC games and AV software.

In order to avoid getting infected, we strongly recommend that you avoid looking for pirated software versions made available via P2P networks and rogue sites online. Instead, you should visit the official software developer’s website and purchase a legitimate license key from there. After all, licenses for secure products always cost less than insane ransoms cybercriminals demand, not even to mention additional expenses resulting from private data loss.

Another common way used to spread ransomware is by obfuscating a malicious script into documents and sending these as attachments to attentively crafted phishing emails. Cybercriminals have a tendency to pretend to be someone they’re not, such as reputable companies like eBay, Amazon, UPS, DHL, or others. These spam emails urge the victim to view attached contents and reply back as soon as possible – however, the last part of this almost never happens once the victim finds out that the email attachment was infectious. The scammers go extreme lengths to trick the victim into thinking that the message comes from a trustworthy entity – for this, they may use email address spoofing techniques, insert logos and official contact information. However, we strongly recommend you to avoid interacting with email attachments or inserted URLs if you have the slightest suspicion about the timing of such email message. Moreover, look out for potential red flags such as typo mistakes in the message, weird alignment of images, or unfamiliar greeting line.

Finally, victims of STOP/DJVU ransomware variants should know that there are many scammers willing to take advantage of users who are already in less than unenviable situation. Watch out for deceptive websites offering data decryption tools as the downloads they offer might be filled with additional ransomware and other threats. Moreover, stay away from scammers suggesting they can recommend a “hacker” who can decrypt your files and promising they have recovered their files successfully. Such scammers might ask you for money and disappear. At the moment, the only tools that can be helpful in decrypting and repairing STOP/DJVU-affected files are from DiskTuna and Emsisoft as explained in this comprehensive guide on our site.

How this ransomware operates

If you’d like to learn mode about WDLO ransomware virus modus operandi, we believe this section will provide you with some answers. The ransomware begins the attack with its main executable which is named with 4 random characters. For example, it might be named as 1H7N.exe or 8B9M.exe. The malware also downloads two helper processes, usually named as build.exe or build2.exe, although we’ve seen samples using build3.exe in the wild as well. Some STOP/DJVU variants also drag a fake Windows update prompt under a name of winupdate.exe to trick the computer user into thinking the sudden system slowdown was caused by legitimate OS updating procedure.

Before the virus begins attack on the files, it first attempts to find out infected computer’s physical location. For this matter, it connects to https[:]//api.2ip.ua/geo.json and downloads a file called geo.json. This file contains details such as computer’s IP address, country, city, zip code, timezone, longitude and latitude. Some examples of geo.json files we have collected during research are provided below.

After finding out victim’s PC location, the virus compares it with its list of countries to avoid attacking. Security researchers have discovered that STOP/DJVU malware ceases its operations in case the compromised PC is situated in one of the following countries: Ukraine, Russian Federation, Syria, Armenia, Kyrgyzstan, Tajikistan, Kazachstan, Belarus, or Uzbekistan. It is unknown why, but cybersecurity experts suggest that it could be a clue that the ransomware operators are from one of the listed countries.

However, if the ransomware detects that the infected computer’s country doesn’t match one from its exception list, it proceeds to the next stage. The virus creates a file called information.txt which contains details about the PC hardware, installed programs, and active processes. The virus also takes a screenshot of the desktop and sends these files to its Command&Control server. Shown below is an example of Information.txt file.

Next, the ransomware attempts to establish a connection with its C&C server to obtain a unique encryption key for the victim. If it succeeds, the victim’s files will be affected with so-called “online encryption” which is impossible to reverse without a unique decryption key.

In cases where the ransomware fails to obtain a key from its server (for example, because of poor Internet connection or if the server is temporarily down) it switches to using a hardcoded offline key for autonomous encryption. This is often referred to as “offline encryption” and is widely known to provide the victim with chances to decrypt files in the future. The way this works is that all victims affected by “offline encryption” are subject to the same decryption key, so if someone pays the ransom, receives the key and shares it with cybersecurity researchers, all victims affected by offline encryption can decrypt .wdlo files for free. However, finding the key in such way takes a long time, so victims should remain patient.

One way or another, the malware saves encryption key along with victim’s ID into bowsakkdestx.txt file and the ID separately to PersonalID.txt file. Now, the assigned ID can reveal which encryption type was used. Go to C:\SystemID\PersonalID.txt and check the last two digits of the string located there. If these are t1, it indicates offline key encryption. In all other cases, online key was used. You can see examples of both files down below.

After deciding which encryption type to use, the ransomware begins encrypting all files using Salsa20 and RSA-2048-bit key. During this procedure, each modified file will be marked with additional .wdlo extension to make affected data distinguishable. You can see how an affected data folder looks like below.

In addition, the ransomware drops ransom-demanding notes called _readme.txt.

Finally, the ransomware modifies Windows HOSTS file to block a set of Internet websites offering various helpful information for ransomware victims. Attempts to visit one of the blacklisted domains will result in DNS_PROBE_FINISHED_NXDOMAIN or similar error code in web browser.

Remove WDLO Ransomware Virus and Decrypt Your Files

If you have fallen victim to a file-encrypting malware attack as described above, you should not hesitate any longer and take action to remove WDLO ransomware virus along with other computer threats. We always recommend our visitors to keep their computers protected with an anti-malware or antivirus solution at all times, but in case you do not have it yet, we strongly recommend INTEGO Antivirus. Make sure you run it after booting your PC in Safe Mode with Networking as explained in the instructions provided below. Booting in this mode helps to deactivate malicious processes that might attempt to interfere with malware removal tool.

In addition, we also suggest that you download RESTORO for best results. This tool is really useful when repairing Windows OS files affected by malware.

If you’ve done with WDLO ransomware virus removal, you might want to take these additional tips into consideration:

• Document the ransomware attack incident to a local law enforcement agency.
• Use data backup drives to recover the majority of encrypted files.
• Learn possible ways STOP/DJVU-encrypted files could be repaired or decrypted.
• Change all passwords used on the infected computer.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.