Geek's Advice

WNLU ransomware compromises Windows systems to encrypt all files on them

WNLU ransomware is part of the widely known STOP/DJVU malware family, and just like other ransomware types, it functions by encrypting files of its victim in such a way it becomes unreadable. It then appends .wnlu extension to each file name, in such a way that a file hitherto saved as 1.jpg is renamed to 1.jpg.wnlu and same format is replicated on other files. While this attack is still ongoing, a ransom note known as _readme.txt is equally dropped simultaneously. What is contained in the ransom note is a notification sent by those behind the cyber-attack informing the victim how to reach out to them so he can pay a ransom in exchange for WNLU decryption tool.  

The cyber attackers will emphasize that the victim has no other option than to comply with their demand if they hope to ever retrieve their important personal information that may include documents, pictures, various data etc. Considering that they made use of strong encryption key that can’t be breached without their permission, they will equally drop certain email addresses for the victim to respond to, such as manager@mailtemp.ch and helprestoremanager@airmail.cc.

They will even go further to list their decryption service prices and the conditions attached with the payment plans. In order to coerce their victims to pay ransom as soon as possible, they offer a 50% discount. This means that they would have to pay $490 instead of the usual cost of $980. However, they will warn that once 3 days elapses, the victim would have to pay the full amount. 

Peradventure the victim decides to get in touch with them; they will inform him that only payments wired through cryptocurrency will be acceptable. So they would provide a wallet address where the victim would be expected to pay the cryptocurrency equivalent of the ransom demand. The major reason why they often use this medium is to cover their tracks and evade possible tracing and arrest. In their desperation to entice the victim into paying the ransom demand, they may even inform the victim to send excerpts from their encrypted data for them to decrypt. This is to prove to the victim of their expertise but will also point out that such excerpt must not contain any information that could be deemed valuable.

Regardless of the situation, our cybersecurity experts advise that victims should NOT PAY ransom and this position is also supported by the FBI in its guidelines in respect to ransom payments. You should bear in mind that complying with ransom demand does not guarantee they will restore your encrypted data. Also, paying them would amount to indirect encouragement to the cybercriminals since they would be more emboldened to continue in their nefarious acts as well as have more funds to employ additional developers. Already, ransomware attacks and accompanying ransom payments is generating millions of dollars but this could be stopped if victims refuse to comply with their demands. 

Aside the encryption of data, this virus usually installs Trojans such as VIDAR or AZORULT that steals vital information from any compromised computer. They are known to pilfer sensitive personal data like banking details, browser saved passwords, software login details, cryptocurrency wallets etc. With such sensitive information in the wrong hands, it could lead to further blackmails.

Anyways, if you’re already a victim of this STOP/DJVU variant, then it is crucial that you remove WNLU ransomware virus as soon as possible. You can do this by activating any reliable antivirus software while your computer is still in Safe Mode with Networking setting. This will enable it to effectively trace and remove any malware infections found in your computer. You can make use of any antivirus of your choice but ensure it is strong enough. However, if there is none you trust, you can always make use of INTEGO Antivirus as recommended by our experts. For virus damage repair on compromised Windows OS files, consider downloading RESTORO.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Ransomware distribution techniques in detail

It is important to note that users mostly get their computer systems infected with WNLU virus and other similar STOP/DJVU ransomware variants when they download malicious torrents. Generally, these viruses often hibernate in pirated software contents, therefore use of fake key generators or “cracks” are highly discouraged to avoid virus infection of your computer system.  

Over the years, victims of ransomware attacks have reported certain software copies the cybercriminals had made use of in creating hazardous license activation tools and “cracks”. These software copies are then uploaded to online torrent libraries. Some of them are listed below:  

• Fifa 20;
• Tenorshare 4ukey;
• Adobe Photoshop;
• AutoCad;
• KMSPico (illegal Windows activation tool).
• Opera browser;
• Corel Draw;
• Internet Download Manager;
• VMware Workstation;
• Cubase;
• Adobe Illustrator;
• League of Legends;

If you’re among those that often visit online torrents to look for pirated software copies, then it’s high time you stopped doing so. Each time you visit such illegal platforms, you will be endangering your computer system since cybercriminals could prey on you at any moment. Meanwhile, trying to get copyrighted software contents illegally from unauthorized sources is wrong and could be prosecuted according to existing laws and criminal penalties. On the contrary, we advise that users should rather obtain their software needs through the official platforms of the original content producers or their authorized third party agents. Whatever amount you pay to obtain software copies legitimately is insignificant relative to the outrageous fees cybercriminals would want to extort from you once you become a victim and moreover there won’t be any risk of losing your sensitive data or being blackmailed. 

Another way they spread ransomware is through malicious email attachments. They do this by composing believable messages with catchy captions, especially on PDF, DOCX or XLS. These particular formats enable macro functions as well as JavaScript both of which are perfect for downloading payload from external sources and could be transferred to any computer. 

Unfortunately, it could be hard to decipher if a particular email is real or from cybercriminals since they are now devising more sophisticated ways of impersonating legitimate brands. They will even go as far as giving the emails catchy names like Invoice, Tracking Details or Order Summary etc. On the other hand, they may even make use of email spoofing techniques to cleverly camouflage the actual originating address. However, everyone should apply desecration when opening emails, especially if such email is not being expected. 

For those who are victims of STOP/DJVU ransomware already, it is important for you to avoid any website that promises to provide decryption services because they’re most likely to be fraudulent. Also note that cybercriminals usually spread other ransomware variants such as ZORAB through fake and ineffective STOP/DJVU decryptors. Do not throw caution to the wind because you’re already infected because such tools can actually worsen your predicament by doubly encrypting your files.

Technical insights on WNLU virus operation

Are you still wondering about the extent of damage that could have been done to your compromised computer following the WNLU ransomware attack? Then this section would come handy to you, as it lays bare all the technical details concerning the virus and how they function. The first thing the malware does is to is to set up build.exe or build2.exe as well as winupdate.exe executables. It then connects to https[:]//api.2ip.ua/geo.json and thereafter saves the outcome on geo.json file. Afterwards, the malware will commence data gathering of every detail conceding your computer, specifically its geolocation, time zone, longitude and latitude, zip code, hardware and software details etc. These set of information are compiled and sent to their main server. 

You can check the image below to see what geo.json file looks like. 

Now that the malware has computed all necessary details about the computer, it will match it against their list of countries where encryption is not allowed, the countries are: Russia, Ukraine, Uzbekistan, Syria, Tajikistan, Belarus, Armenia, Kazachstan, and Kyrgyzstan. If the information shows that the computer is located in any of the listed countries, it will immediately abort its operation. But if it is negative, it will move to the next stage by fetching the online encryption key from its database and saves it alongside the victim’s ID, in bowsakkdestx.txt file and to PersonalID.txt file.

Examples of these files are shown below.  

If for any reason, the virus couldn’t extract an online encryption ID, it will immediately resort to the use of an offline encryption ID. Note that offline ID is uniform for all victims provided they were all infected by same variant. You can detect if an offline key was used by checking if the t1 characters were appended to your personal ID. If such is the case, it brightens your chances of being able to decrypt .wnlu files someday.  You can avail yourself more information about this below the article or in this guide.

Moreover, the virus collects information about the computer (hardware, active processes, installed software, computer name and other details) and saves them to information.txt file as shown below. Moreover, the virus transmits these details to the attacker’s server as well.

At this point, the ransomware will begin full data encryption by scanning all folders contained in your computer and encrypting them with Salsa20 before eventually locking the encryption key using RSA-2048 key. It is also during this phase that the virus marks each file with more extensions.

Captured in the image below is screenshot of _readme.txt ransom note that are left in every folder.  

The virus will then delete Volume Shadow Copies by making use of the Command Prompt task as shown here:

^{vssadmin.exe Delete Shadows /All /Quiet}

To complete its mission, the virus will identify the localhost IP and add the domains now contained in the Windows HOSTS file. If the victim decides to open any of the blocked websites, DNS_PROBE_FINISHED_NXDOMAIN error message may appear on the screen. The main reason why the cybercriminals do this is to prevent you from getting any form of assistance online. The virus will then release more malware on the compromised system like VIDAR Trojan or AZORULT as mentioned earlier. 

Remove WNLU Ransomware Virus and Recover Your Files

For those at the receiving end of this malware variant attack, it is advisable for you to inform relevant local authorities about the situation and of course, you remove WNLU ransomware virus immediately. You can leverage the guide provided below to start your computer using the Safe Mode with Networking method. This method will enable the antivirus to function optimally. If you don’t know of any reliable antivirus you can trust to do a perfect job, we recommend INTEGO Antivirus which is among the best antivirus you can get out there. Additionally, we recommend scanning with RESTORO to repair inflicted virus damage on Windows OS files.

After completing the WNLU ransomware virus removal, you can go through the following steps as recommended by our in-house experts: 

• Inform relevant local authorities about the situation;
• Make use of data backup to restore your files but ensure your computer is completely rid of the malware before embarking on this;
• Study how STOP/DJVU versions can be decrypted;
• Change all passwords associated with the compromised computer.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.