Viruses

Zoqw Ransomware, being a part of STOP Ransomware is a critical virus, endangering user's personal files. It belongs to the family of file-encrypting malware, that uses the AES (Salsa20) algorithm and unbreakable key. This virus is, sometimes, called Djvu Ransomware, after the word used as an extension in the first versions (.djvu). The variant of the threat, that we describe today, modifies files with .zoqw extension appeared in first half of January 2023 and acts exactly the same in comparison with dozens of previous versions. Files are encrypted with a secure key and there are quite small chances to decrypt them completely, especially if an online key was used. However, certain manual methods and automatic tools, described in this article can assist you in successfully decrypting some data. In the text box below you can find the "ransom note" - a small text file with a brief virus introduction and instructions to pay the ransom.

One of the main computer security threats today is ransomware. Those are devastating computer viruses, that encrypt users' files using various cryptographic algorithms and extort ransom money for the decryption key. It is especially sensitive for users, as it attacks either personal files such as videos, photos, music, or business data such as MS Office file formats, e-mails, databases. Such files can be crucial for business operation or extremely important personally as part of family memory. Malefactors can demand from several hundred to several thousand dollars as a ransom. STOP Ransomware is officially the most widespread and therefore most dangerous ransomware threat. There've been more, than 650 versions of this virus in 5 years. Each variation infects thousands of computers, and there are millions of victims of this nasty malware. In this article, we will explain typical methods to fight Bpto Ransomware and decrypt affected files. In today's focus, versions of STOP (Djvu), that add .bpto extensions. Recent samples use a very similar pattern to infiltrate PCs and encrypt files. After encryption, ransomware creates a file (ransom note), called _readme.txt.

Theva is the name of a ransomware virus that encrypts system-stored data and demands victims to pay money in Bitcoin for its decryption. During encryption, targeted files end up visually altered - for instance, 1.pdf will change to 1.pdf.[sql772@aol.com].theva and so forth with other files. Upon successful blockage of data, Theva Ransomware represents its decryption instructions in a text document called #_README_#.inf. It also changes victims' desktop wallpapers. In order to recover the data, victims are urged to contact cybercriminals via the given e-mail address (sql772@aol.com) and pay the ransom in Bitcoin cryptocurrency. It is said the price for decryption depends on how fast victims establish contact with swindlers. Following successful payment, threat actors promise to send the necessary decryption tool that will unlock all blocked data.

Eternity is a ransomware virus that was discovered by Cyble researchers. This piece of malicious software belongs to the Eternity malware family and is designed to extort money from victims by encrypting potentially valuable data (with secure AES and RSA cryptographic algorithms). Dasha is another popular ransomware variant from this family. There are two known versions of Eternity - one does not change files visually and the other assigns the .ecrp extension to filenames and alters original icons. For instance, 1.pdf may either remain the same or become 1.pdf.ecrp after encryption depending on which ransomware version attacked the system. After successfully completing encryption, Eternity displays a pop-up window containing decryption instructions. Because Eternity Ransomware is a public Malware-as-a-service (MaaS) virus, which many threat actors may buy, the content of instructions (contact details, ransom size, countdowns, etc.) may slightly vary as well. Below are examples of ransom texts from two ransomware variants.

Black Hunt is a malicious infection classified as ransomware. Upon infiltration, it begins encrypting data and then blackmails victims into paying for decryption (in #BlackHunt_ReadMe.hta and #BlackHunt_ReadMe.txt ransom notes). While running encryption, the virus also assigns the victim's ID, cybercriminal's email address, and .black extension to influenced files. To illustrate, a file originally named 1.pdf will change to something like 1.pdf.[nnUWuTLm3Y45N021].[sentafe@rape.lol] and acquire the new Black Hunt icon as well. Desktop wallpapers get altered as well. Inside the ransom notes cybercriminals state victims have 14 days to contact them by e-mail and buy a unique key for decryption. Unless the deadline is met, threat actors say they will start selling or leaking the collected data to various third-parties. Victims can review their "data situation" via the provided TOR link.

ScareCrow is a ransomware infection that first appeared on malware radars in 2019. Since then, the ransomware has undergone a couple of insignificant changes and upgrades. For instance, depending on which ScareCrow versions attacked the system, either .scrcrw or .CROW extensions will be assigned to targeted files. Ransomware infections are designed to encrypt potentially valuable data and hold it blocked until victims meet cybercriminals' demands to pay a ransom. ScareCrow uses a combination of AES and RSA cryptographic algorithms to thoroughly encryption of data. After successfully making files inaccessible, the virus automatically opens a pop-up window with decryption instructions. Please note that paying the ransom might not be mandatory - victims are advised to contact reputable ransomware researcher Michael Gillespie and decrypt ScareCrow files for free.

BrasDex is categorized as a banking virus that infects Android (and Windows) devices to access bank accounts and steal money from victims. This specific banker has been observed targeting victims in the Brazilian region - recently via a fake banking app named "Brazilian Banco Santander". Previously, it used to infiltrate devices by disguising itself as essential Android settings applications. BrasDex abuses Accessibility Services to record the information entered into banking applications. However, instead of showing overlaid (fake) screens to bait users into entering their log-in credentials, it instead keyloggers them inside targetted banking applications themselves. Unlike other banking malware, BrasDex also employs an ATS (Automated Transfer System) mechanism, which allows cybercriminals to perform fraudulent transactions in an automated way - therefore automating malicious business and increasing illegal profits. In addition, it is also known that BrasDex exploits a popular Pix fast payment system that was developed by the Central Bank of Brazil. This makes its easier for cybercriminals since all they require is the victim's identifier (which can be an email, CPF, phone number, or random ID). Please note that the Pxi system is not vulnerable - threat actors simply use this system to speed up the process of fraudulent transfers. A lot more technical information about BrasDex can be discovered in this report made by ThreatFabric. BrasDex is a dangerous virus that can cause unpleasant financial losses and privacy issues - thus, make sure to read our guide below and delete this devastating malware from your device. Once done, it is also important to change your log-in credentials.

GodFather is the name of a banking trojan that targets Android devices. Developers behind this malware seek to exfiltrate account credentials and use them for accessing 400+ online banking pages and crypto exchanges across 16 countries worldwide. The GodFather trojan functions by creating overlaid log-in screens and displaying them over legitimate apps or web pages. This way, it tricks users into entering their login data on fake screens, which allows threat actors to access finance-related accounts and abuse them for financial fraud. Before GodFather becomes capable of performing such malicious action, it needs users to allow certain permissions (access to SMS texts and notifications, screen recording, contacts, making calls, recording to external storage, and reading the device status) in the Accessibility Service window. The trojan does it by imitating the legitimate "Google Protect" tool, therefore making the process look ordinary and less likely to trigger suspicion from users. After the permissions are granted, the trojan gets complete liberty to run its malicious actions. GodFather also abuses the granted access to complicate manual removal, steal two-factor authentication codes, process different commands, and hijack data from PIN and password fields. If you want to learn more about the technical specs of GodFather banking trojan, you can check out this page. In summary, GodFather is a highly-devastating infection that can lead to significant financial losses, which is why it must be removed completely and without traces from your device. Use our guide below to do it.