Secuestro de datos

Virus QEHU (.archivo qehu) Secuestro de datos

¿Qué es el virus QEHU??

QEHU un tipo de ransomware STOP/Djvu, cifra archivos en computadoras, making them inaccessible. It targets a variety of file types, appending a “.qehuextension to them, which renders the files unusable without a decryption key.

After infecting a system, Qehu demands a ransom in Bitcoin for decrypting files. Victims find a_readme.txtguide on desktops and within folders that instructs them on how to make the payment, though payment does not guarantee recovery.

The virus employs the Salsa20 encryption algorithm, which complicates decryption efforts without the attacker’s cooperation. Sin embargo, if Qehu cannot connect to its server before starting the encryption, it uses a standard offline key, offering a potential avenue for decryption.

Abajo, an image shows the appearance of encrypted files, marked by the “.qehuextension:

Encrypted Qehu Files: Windows PC

Encrypted Qehu Files: Windows PC

NombreQehu Virus
Familia 1STOP/Djvu Ransomware
Extension.qehu
Ransomware note_readme.txt
RansomFrom $499 a $999 (in Bitcoins)
Contactsupport@freshingmail.top, datarestorehelpyou@airmail.cc
Symptoms
  • Encrypts most of your files (photos, videos, documents) and adds a particular “.qehuextension;
  • Deletes Volume Shadow copies to make attempts to restore data impossible for the victim;
  • Adds a list of domains to the HOSTS file to block access to certain security-related sites;
  • Installs a password-stealing Trojan on the system, like Vidar Stealer or RedLine Stealer;
  • Manages to install a SmokeLoader backdoor;
RecoveryStart recovery with a comprehensive antivirus scan. Although not all files may be recoverable, our guide outlines several potential methods to regain access to encrypted files.

Qehu Virus Overview

Qehu ransomware executes a set of procedures on a victim’s computer upon arrival. It launches winupdate.exe as one of the initial processes, which displays a fraudulent Windows update prompt during the attack to convince the victim their PC is slowing down due to a Windows update.

Meanwhile, the ransomware runs another process (named with 4 random chars), which begins scanning the computer for target files and encrypting them. It then removes Volume Shadow Copies from the system using the following CMD command:

vssadmin.exe Delete Shadows /All /Quiet

Once removed, it becomes impossible to retrieve the computer’s previous state using System Restore Points. The ransomware operators eliminate any built-in Windows approaches that could help the victim restore files for free. Además, they modify the Windows HOSTS file by adding a list of domains to it, redirecting them to the localhost IP, which results in a DNS_PROBE_FINISHED_NXDOMAIN error when the victim tries to open one of the blocked websites.

We’ve observed that the ransomware tries to restrict websites from publishing various how-to guides for computer users. Clearly, by limiting specific domains, the attackers attempt to prevent victims from accessing relevant and helpful online information related to ransomware attacks. The virus also stores two .txt files on the victim’s computer providing attack-related information – the public key of this victim and a personal ID, named bowsakkdestx.txt and PersonalID.txt.

After all these modifications, the malware doesn’t stop. Variants of STOP/DJVU often deploy the Vidar password-stealing Trojan on compromised systems, a threat with a vast list of capabilities, incluido:

  • Infiltrating and executing malware on the victim’s computer to gain unauthorized access.
  • Obtaining unauthorized access to login credentials of Steam, Telegram, and Skype.
  • Manipulating and viewing files on the victim’s computer without their consent.
  • Stealing cryptocurrency wallets from the victim’s system.
  • Granting the hackers remote control over the victim’s computer for various malicious purposes.
  • Extracting sensitive information such as browser cookies, saved passwords, and browsing history.

The cryptography algorithm in STOP/Djvu ransomware is Salse20. So, once it encrypts your data with an online decryption key, the chances of getting your files back become quite low. This key is unique for each victim, and finding a suitable one would take an impractical amount of time.

Retrieving the online key in another way is also nearly impossible. The hackers spread the Qehu infection on the server where it is stored. To receive the decrypting code, the payment should be $999. For payment details, the victims must contact the hackers by email (support@fishmail.top).

Ransom Note: _readme.txt

Ransom Note: _readme.txt

How To Remove?

Remove Qehu Virus with Gridinsoft Anti-Malware

También hemos estado utilizando este software en nuestros sistemas desde entonces., y siempre ha tenido éxito en la detección de virus.. It has blocked the most common Ransomware as mostrado en nuestras pruebas con el software, and we assure you that it can remove Qehu Virus as well as other malware hiding on your computer.

Antimalware Gridinsoft - Pantalla principal

Para utilizar Gridinsoft para eliminar amenazas maliciosas, sigue los pasos a continuación:

1. Comience descargando Gridinsoft Anti-Malware, accesible a través del botón azul a continuación o directamente desde el sitio web oficial gridinsoft.com.

2.Una vez que el archivo de instalación de Gridinsoft (setup-gridinsoft-fix.exe) se descarga, ejecutarlo haciendo clic en el archivo. Follow the installation setup wizard's instructions diligently.

Asistente de configuración de Gridinsoft

3. Acceder al "Pestaña Escanear" on the application's start screen and launch a comprehensive "Análisis completo" para examinar toda su computadora. Este escaneo inclusivo abarca la memoria., elementos de inicio, el registro, servicios, conductores, y todos los archivos, asegurando que detecta malware oculto en todas las ubicaciones posibles.

Scan for Qehu Virus Ransomware

Ser paciente, as the scan duration depends on the number of files and your computer's hardware capabilities. Utilice este tiempo para relajarse o atender otras tareas..

4. Al finalizar, Anti-Malware presentará un informe detallado que contiene todos los elementos maliciosos y amenazas detectados en su PC.

The Qehu Virus was Found

5. Seleccione todos los elementos identificados del informe y haga clic con confianza en el "Limpio ahora" botón. Esta acción eliminará de forma segura los archivos maliciosos de su computadora., transfiriéndolos a la zona de cuarentena segura del programa antimalware para evitar futuras acciones dañinas.

The Qehu Virus has been removed

6. Si se le solicita, reinicie su computadora para finalizar el procedimiento de escaneo completo del sistema. Este paso es crucial para garantizar la eliminación completa de cualquier amenaza restante.. Después del reinicio, Gridinsoft Anti-Malware se abrirá y mostrará un mensaje confirmando la finalización del escaneo.

Recuerde Gridinsoft ofrece una prueba gratuita de 6 días. Esto significa que puede aprovechar el período de prueba sin costo alguno para experimentar todos los beneficios del software y prevenir futuras infecciones de malware en su sistema.. Embrace this opportunity to fortify your computer's security without any financial commitment.

Video Guide

How To Decrypt .qehu Files?

First, try deleting the “.qehuextension from a few big files and then opening them. This malware struggles with the encryption of large files. The virus either failed to lock the file upon access or encountered a bug and omitted to add the file marker. If your files exceed 2GB in size, the latter scenario is more probable.

Criminals released the newest extensions around the end of August 2019 after making several changes.

The changes by the criminals rendered STOPDecrypter unsupported, leading to its replacement with the Emsisoft Decryptor for STOP Djvu Ransomware developed by Emsisoft.

  1. Download and Run the Decryption Tool: Download decryption tool. Ensure you run the decryption utility as an administrator and agree to the license terms that appear by clicking the” botón. Upon accepting the license terms.
  2. Select Folders for Decryption: The decryptor, by default, automatically selects directories on connected and network drives for decryption. Use theAddbutton to select additional locations. Depending on the malware family, decryptors offer various options, which you can toggle on or off in the Options tab. Abajo, you will find a detailed list of the currently active options.
  3. Initiate Decryption by Clicking on theDecryptButton. After adding all desired locations to the list, click theDecryptbutton to start the decryption process. The decryptor will inform you upon completing the decryption process. If needed for documentation, you can save the report by clicking theSave log” botón. It’s also possible to copy the report to your clipboard for pasting into emails or messages.

How to Restore .qehu Files?

In some cases, ransomware fails to encrypt your files

The Qehu ransomware encryption process involves encrypting each file byte-by-byte, creating a duplicate, and then deleting (not overwriting) the original file. This deletion means the physical disk no longer lists the file in its system, although the original file remains on the drive. The sector that held the file might still contain it, but since the system does not list it, new data can overwrite it. Sin embargo, special software can recover your files.

Solution 1Solution 2
This virus managed to bypass two antivirus programs and two malware fighters and infect my PC.

Realizing it was an online algorithm, I knew recovering my encrypted files was impossible. My backup drive, connected during the infection, seemed infected as well. Every folder on my backup drive appeared encrypted. Despite this, I managed to recover nearly 80% of my 2TB storage.

Examining the folders, I found ransom notes in each. Opening some revealed that only files not in subfolders were encrypted. Delving into subfolders in other folders, I discovered unencrypted files. Unlike my C and D drives where every folder, including subfolders, was encrypted, my backup drive’s subfolders saved 80% of my data.

I consider finding this loophole on my backup drive fortunate. Además, I recovered another 10% of my data from a hard drive on a different PC. Thus, my advice for using a backup drive is to create subfolders. It was partly luck, but also misfortune that the virus struck during file transfers from my backup.

I hope this experience can assist others in similar predicaments.

Jamie Newland
Here are some tips for Qehu file recovery and repair (applicable to all STOP/DJVU variants):

  • Check deeper nested folders since some Stop/Djvu variants fail to encrypt them, leaving them unencrypted.
  • Since this ransomware saves encrypted data to a new file and deletes the original, there’s a chance to recover parts of the deleted file using file recovery software. Although restoring the folder structure is unlikely, a tool like PhotoRec might work well.
  • The ransomware partially encrypts files (about the first 150 KB), making it possible to recover the non-encrypted portion depending on the file size and type.
  • Joep
    Brendan Smith
    Brendan Smith
    Experto en seguridad informática
    Try to use the GridinSoft Anti-Malware
    Do not forget to share your experience in solving the problem. Please leave a comment here! This can help other victims to understand they are not alone. And together we will find ways to deal with this issue.
    Antimalware
    Prueba de 6 días de Gridinsoft Anti-Malware disponible.
    CLUF | política de privacidad | 10% Cupón de descuento

    Recover Qehu Files with PhotoRec

    PhotoRec, designed for file recovery from damaged disks or accidental deletion, now supports restoring 400 file types, making it useful after a Qehu attack.

    First, download PhotoRec. It’s free, but the developer offers no guarantee for file restoration. PhotoRec comes packaged with TestDisk, another tool from the same developer, under the TestDisk name. Sin embargo, PhotoRec is included within the archive.

    To start PhotoRec, open the qphotorec_win.exe file. No installation is necessary as the program contains all required files, allowing it to run from a USB drive.

    1. My files are encrypted by ransomware, what should I do now?

    Sobre el Autor

    Brendan Smith

    I'm Brendan Smith, un periodista apasionado, investigador, y desarrollador de contenidos web. Con un gran interés en la tecnología informática y la seguridad., Me especializo en ofrecer contenido de alta calidad que eduque y capacite a los lectores para navegar en el panorama digital..

    Enfocados en tecnología informática y seguridad., Estoy comprometido a compartir mis conocimientos y perspectivas para ayudar a personas y organizaciones a protegerse en la era digital.. Mi experiencia en principios de ciberseguridad, privacidad de datos, y las mejores prácticas me permiten brindar sugerencias y consejos prácticos que los lectores pueden implementar para mejorar su seguridad en línea..

    Deja un comentario