Viruses

SUPERSUSO is a ransomware program that uses strong encryption algorithms to cut users from accessing their own data. Such a change is meant to stimulate people into paying the so-called ransom to recover encrypted files. Victims will learn about file encryption by new extensions assigned to them. SUPERSUSO developers use the .ICQ_SUPERSUSO extension to rename all the blocked data. For instance, a file like 1.pdf will change to 1.pdf.ICQ_SUPERSUSO and reset its original icon. The same will be applied to all data blocked across your system. After this, SUPERSUSO issues a text file named #Decrypt#.txt to explain recovery instructions. At first, victims are instructed to install ICQ software for PC, Android, or IOS and write to cybercriminals' recipient address, which is mentioned in the note. ICQ is a reliable and legitimate messenger used by cybercriminals to establish anonymous communication with their victims. Should victims fail to contact developers within 72 hours, the compromised information will be gathered and leaked to darknet markets.

Shasha is the name of a ransomware virus that encrypts and changes data with the .shasha extension. The new extension is not an essential part of the encryption, but rather a visual aspect meant to highlight the blocked data. If you see this extension assigned to most of the data like this 1.pdf.shasha, then you are undoubtedly infected with ransomware. The developer's next step after blocking access to files is to explain how to recover it back. For this, cybercriminals in charge of the Shasha virus create a text note called READ_ME.txt and change desktop wallpapers. Inside of this note, extortionists claim they are the only figures able to decrypt your files. To be more precise, they are the ones holding private keys and decryption software that can unlock the data. Victims are requested to buy it for 50$ in BTC. The payment has to be sent through the Bitcoin address attached in the note. Unfortunately, it is quite uncertain how cybercriminals are going to send the purchased decryption software to you.

CommonRansom is classified as a ransomware virus that encrypts data stored on infected devices to demand payment for its return. This version was discovered by a malware researcher named Michael Gillepsie. Just like many ransomware infections, CommonRansom assigns its own extension to highlight the blocked data. All data that got encrypted by CommonRansom will change like this file here - 1.pdf > 1.pdf.[old@nuke.africa].CommonRansom. After this, one more thing left to initiate by the virus is ransom note creation. The name of the note is DECRYPTING.txt and it is put to each folder with infected files. This note says victims have 12 hours ahead to request data decryption, otherwise, there will be no chance to return it anymore. There is also a template that should be used when contacting cybercriminals by their e-mail address. The attached template is actually very suspicious since it requests victims to write their PC RDP port, a username along with password used to log into the system, and the time when you paid 0.1 BTC to the outlined crypto address.

Gyjeb is a ransomware virus that runs data encryption to extort money from victims. It looks very similar to Keq4p Ransomware, which means they are likely to come from the same malware family. Just like Keq4p, Gyjeb Ransomware assigns a random string of senseless symbols along with its own .gyjeb extension. To illustrate, a file like "1.pdf" will change its look to something like 1.pdf.wKkIx8yQ03RCwLLXT41R9CxyHdGsu_T02yFnRHcpcLj_xxr1h8pEl480.gyjeb and reset its original icon. After all files end up edited this way, the virus creates a text note called nTLA_HOW_TO_DECRYPT.txt which entails decryption instructions. You can familiarize yourself with this note in the screenshot below.

Keq4p is a ransomware infection that encrypts personal data using cryptographic algorithms. These algorithms ensure strong data protection from attempts to decrypt it. Files attacked by ransomware are usually photos, videos, music, documents, and other types of data that could entail some value. Most file-encryptors change all the affected files by assigning their own extension. Keq4p does exactly the same, but also attaches a random string of symbols. For instance, a file like 1.pdf will change to something like 1.pdfT112tM5obZYOoP4QFkev4kSFA1OPjfHsqNza12hxEMj_uCNVPRWni8s0.keq4p or similar. The assigned string is totally random and has no real purpose. Along with visual changes, Keq4p closes its encryption process with the creation of zB6F_HOW_TO_DECRYPT.txt, a text file containing ransom instructions. You can take a closer look at what it contains in the following screenshot.

Hydra is a ransomware infection that makes users' data inaccessible by running thorough encryption. Besides being unable to access the data, users may spot some visual changes as well. Hydra assigns a new string of symbols containing cyber criminals' email addresses, randomly generated ID assigned to each victim, and the .HYDRA extension at the end. To illustrate, a file like 1.pdf will change its look to [HydaHelp1@tutanota.com][ID=C279F237]1.pdf.HYDRA and reset the original icon to blank. As soon as all files end up encrypted, the virus promotes ransom instructions to guide victims through the recovery process. This can be found inside of #FILESENCRYPTED.txt text note, which is created after encryption. Hydra developers say victims can restore their files by writing to the attached e-mail address (HydaHelp1@tutanota.com or HydraHelp1@protonmail.com). After this, cybercriminals should give further instructions to purchase the decryption of files.

Delta Plus is a ransomware-type virus that uses cryptographic algorithms to encrypt personal data. It assigns strong ciphers that are hard to decode without special decryption tools held by cybercriminals themselves. To buy these tools, victims are requested to send the equivalent of 6,000 USD in BTC to a crypto address. The price for decryption may be also reduced to 3,000 USD if you manage to complete the payment within the first 72 hours after being infected. All of this information is disclosed inside of the text note called Help Restore Your Files.txt, which is created as soon as the encryption of files is done. Delta Plus appends the .delta extension to all affected files. For instance, a file like 1.pdf will change to 1.pdf.delta and lose its original icon. After these changes, users will no longer be able to access their files until they pay the required ransom.

Discovered by Tomas Meskauskas, Koxic is determined to be a ransomware infection that operates by encrypting PC-stored data. In other words, the majority of files like photos, videos, music, and documents will be blocked by the virus to prevent users from accessing them. All files encrypted also get new .KOXIC or .KOXIC_PLCAW extensions. This means encrypted files like 1.pdf will change to 1.pdf.KOXIC or 1.pdf.KOXIC_PLCAW. The same pattern will be applied to residual data encrypted by ransomware. After getting things done with encryption, the virus creates a text note that explains ransom instructions. These instructions state victims should contact developers via koxic@cock.li or koxic@protonmail.com e-mails with their personal ID. This ID can be found attached to the ransom note. If there is no such being visible, there is a chance some version of Koxic Ransomware that infiltrated your system is still under development and being tested.