Geek's Advice

YBER ransomware is the latest addition to the STOP/DJVU ransomware strain

YBER ransomware is a new file-encrypting malicious virus emanating from the STOP/DJVU ransomware family. It functions by encrypting every file contained in any computer it infects and also appends .yber extension to each file name. For instance, a file originally saved as 1.jpg is automatically renamed 1.jpg.yber, and same procedure is replicated on all other data. While the attack is still taking place, the ransomware would drop ransom notes known as _readme.txt in all the folders. Contained in the notes are direct messages from the cybercriminals informing the victim about the cyber-attack and the need for them to communicate with them and pay ransom in exchange for a YBER decryption tool.

They will elaborate that YBER ransomware virus has compromised their entire files, including documents, pictures, and every other data contained in the computer and for them to be able to retrieve them, ransom would have to be paid. The cybercriminals would claim that very strong encryption key was used but once the victim pays ransom, they would decrypt the files for them. These two email addresses: support@sysmail.ch and helpsupportmanager@airmail.cc. would also be contained in the message and the victim would be expected to respond via them.

Furthermore, prices of decryption services, as well as payment conditions, would also be attached alongside. It will state that victims would be afforded a 50% discount on the ransom fee if they can be able to pay within 3 days or 72 hours of being notified. Therefore, they would have to $490 instead of the normal $980 ransom fee but if they fail to pay within that period, only the full ransom would be acceptable to them.

However, if the victim goes ahead to contact them, they will inform him payment can only be made with cryptocurrency of their choice. So, the victim would have to purchase the cryptocurrency equivalence of the ransom and pay into a wallet address they would send to him. They make use of this channel because of the anonymity it provides and thus avoid any chance of being traced and arrested. To show they have what it takes to restore the victim’s encrypted data, they may request for excerpts to be forwarded to them for test decryption.

Our in-house cybersecurity experts recommend that victims SHOULD NOT PAY RANSOM and it’s interesting to note that FBI equally gave similar recommendation. Victims should understand that paying ransom does not mean the cybercriminals would honor their part of the bargain. Also, when you pay ransom, you’re encouraging them to continue earning from their criminal activity and they would have more funds to recruit additional hands and grow their capacity. Already, ransomware operators extort millions of dollars from victims across the globe but all hands must be on deck in order to stop them or at least reduce their activities to the barest minimum.

Moreover, cybercriminals are known to drop deceptive Trojans like VIDAR and AZORULT that would infiltrate an already compromised computer and steal vital personal information such as cryptocurrency wallets, banking details, credentials for software account login, passwords etc. They could use these sensitive details to commit more fraudulent acts like theft or blackmail.

Victims of any STOP/DJVU variant should endeavor to remove YBER ransomware from their computer without any delay. This can be done effectively with genuine and reliable antivirus while the computer is made to run on Safe Mode with Networking. One of the best antivirus for Windows is INTEGO Antivirus, which ensures 24/7 protection against malware. Additionally, the tool that we usually recommend using for repairing virus-affected Windows OS files can be downloaded here – RESTORO.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Methods used in distributing Ransomware

One of the most common ways computer users trigger variants of STOP/DJVU ransomware virus is when they download malicious torrents. The cybercriminals would hide the virus in “cracks” and fake key generators among other pirated software copies and they become activated when uploaded in any computer. Majority of victims over the years have reported using certain software copies downloaded illegally before realizing they were infected. Listed below are some of the software copies cybercriminals usually exploit in spreading ransomware:

• Cubase;
• Adobe Photoshop;
• Fifa 20;
• Tenorshare 4ukey;
• AutoCad;
• Opera browser;
• Corel Draw;
• VMware Workstation;
• Adobe Illustrator;
• League of Legends;
• Internet Download Manager;
• KMSPico (illegal Windows activation tool).

Computer users that have formed habit of visiting online software torrents should desist from doing so because it’s quite risky. Such places are a haven for cybercriminals and they usually prey on unsuspecting visitors. Moreover, downloading copyright contents illegally can be subject to prosecution in law court. Instead of risking all these, it is much better to obtain software contents legitimately. Whatever price the content developers request for can’t be compared to the huge sums of money cybercriminals usually demand from their victims. Likewise, you won’t be endangering your important and sensitive personal data.

Another distribution method commonly used by cybercriminals is through malicious email attachments. When it comes to this method, they have continuously upped their gimmicks in desperation to continue swindling more victims. They often disguise as genuine their messages as if they were sent for authentic purposes. Making use of platforms that allow JavaScript or Macro Functions such as DOCX, PDF or XLS, they will create believable emails alongside malware-carrying attachments. Such emails will be disguised to appear they coming from reputable brands or acquaintances with enticing names/headings such as Order Summary, Invoice or Tracking Details among others. Sometimes they make use of email spoofing techniques to obfuscate the actual originating email address. When faced with such suspicious emails, you’re advised to apply caution and not just open the message or the accompanying attachment because doing so can trigger the activation of ransomware on your computer.

Victims of STOP/DJVU often assume that the worst has happened and they throw caution to the wind in their search for decryption solutions. Unfortunately, most of the websites claiming to provide decryption services are fraudulent. More often than not, the rogue operators behind them have ulterior objectives such as spreading of other versions of ransomware like ZORAB through the so-called STOP/DJVU decryptors.

More details about the ransomware

This section covers the technical aspect of what happens during YBER ransomware attack. The thing the ransomware does is to set up a build.exe or build2.exe and also winupdate.exe (the fake screen that displays Windows update). The ransomware then hooks up with https[:]//api.2ip.ua/geo.json before saving the outcome on geo.json file. The ransomware now begins information gathering whereby important details about the computer geolocation, including its zip code, geolocation, latitude and longitude, time zone etc. would be compiled and sent to central server.

The image below is an example of geo.json files.

The virus also gathers information about computer’s hardware/software details as well as active processes into information.txt file as shown below.

The malware will then make use of country code to determine if the geolocation is within any of their encryption protected countries. The list includes Russia, Tajikistan, Kazachstan, Ukraine, Armenia, Uzbekistan, Belarus, Kyrgyzstan and Syria. Once it can determine that the location is within any of these countries, it will automatically stop any further action. However, if it indicates negative, the ransomware would collect online key from the central server which it now combines with the victim’s ID before forwarding them to bowsakkdestx.txt file and to PersonalID.txt file.

Example of these files is shown in the image below.

In situation whereby the ransomware couldn’t get hold of an online encryption ID, it will opt for offline encryption ID. Online ID’s are unique per victim while offline ID are uniform for all victims of the same variant. Victims can easily decipher between online and offline ID because the latter would contain t1 characters at the end of the personal ID. If offline ID is used, it means there is a possibility that one could decrypt .yber files going forward. More in this is provided in this guide.

At this juncture, the ransomware will commence full data encryption process. It will scan every folder and encrypt the files with the Salsa20 algorithm before locking the encryption with the RSA-2048 key. While this is still going on, files contained in the computer will be marked with additional extensions.

Shown in the screenshot below is an example of the _readme.txt ransom note the ransomware drops in every folder.

The virus will start deleting Volume Shadow Copies using the Command Prompt task displayed below:

^{vssadmin.exe Delete Shadows /All /Quiet}

Before concluding the process, the virus will add particular domains to the Windows HOSTS file and links them with the localhost IP. Once this is done, the victim will be effectively barred from accessing any of those websites. When they click on them, the DNS_PROBE_FINISHED_NXDOMAIN error message is what would appear on the screen. The reason why it does this is to preempt possible attempts by the victim to seek help from some websites. The ransomware would increase the malware load on the computer system, including Trojans like VIDAR and AZORULT as mentioned earlier.

Remove YBER Ransomware Virus and Restore Your Files

The two most important things victims of any variant of STOP/DJVU ransomware should do following a cyber-attack is to inform relevant local authorities about it and also to remove YBER ransomware virus as quickly as possible. To remove the virus, you can use a strong antivirus while your computer is set up on Safe Mode with Networking.
Below are the recommended steps that should be taken by victims of ransomware attack:

• You should remove the virus as quickly as possible.
• Go to the nearest government agency that is mandated to oversee such issues and inform them about it.
• Now is the time to put your backup devices to good use, but ensure that the virus is completely removed before plugging any external device to the computer.
• Change all passwords that were directly or remotely used on the computer.
• You may as well consider learning how to decrypt/repair files that were affected by STOP/DJVU variants.

In conclusion, modern use of the cyberspace requires carefulness. Most of the problems associated with ransomware attack can be avoided if computer users apply a little more caution, decency and smartness. If everyone should take proactive measures as outlined in this article, cybercriminals won’t be able to prey on their victims, at least not on the current scale.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.