Wbxd ransomware – a file-locking virus that demands cryptocurrency payment for the decryption software
Wbxd ransomware is a cryptovirus that's developed to racketeer its victims to buy an alleged decryption tool after it encrypts personal data with a military-grade RSA coding algorithm. It also generates a ransom note titled _readme.txt and places it on the computer's desktop, in folders with the encoded files. It urges the victims to establish contact via two given emails – helpmanager@mail.ch and restoremanager@airmail.cc. Criminals state that this is the only way to get your files back, but the decryption tool, in most cases, is not provided.
During encryption, personal files such as archives, pictures, documents, etc., are renamed by appointing a .wbxd extension to their original filenames. So if you had a file that was called 1.docx, it would now appear as 1.docx.wbxd. All files are undamaged but rendered inaccessible until a specific decryption software is used that takes the code back to the original.
An official tool that could surely help with encrypted files is not developed yet, but the Emsisofts Djvu decryption tool can work in some of the cases. It operates by determining if encryption happened using offline or online IDs. If the procedure was launched with the help of offline keys – the tool could restore affected files. You can upload your files to check if that is even possible. Otherwise, the best option for such infection remains data backups and thorough system cleaning using AV tools.
Reports indicate[1] that the Djvu ransomware family was the most commonly reported ransomware strain in the third quarter of 2020, and the Wbxd virus belongs to this family. File-locking malware from this lineage was first detected in December of 2018, and since then, it's been terrorizing everyday computer users all over the world. Many changes have been done, so each version that comes out is more powerful.
| name | Wbxd ransomware |
|---|---|
| Type | Malware, ransomware |
| Family | Djvu |
| appended file extension | Original filenames receive .wbxd extension |
| Ransom note | _readme.txt |
| Ransom amount | $490/$980 depends on whether the victims contact their assailants within 72 hours of the attack |
| Criminal contact details | Threat actors provide two emails to reach out to them: helpmanager@mail.ch and restoremanager@airmail.cc |
| Distribution | File-sharing platforms, spam emails, deceptive ads |
| Data recovery options | You can try using the tool from Emsisoft, but that decryptor only works for particular versions. Another option is the media file repair tool that restores particular types of data. The best option would be replacing those affected files with data from backups or using third-party software. You can find a guide below with alternatives |
| Virus removal | Eliminate ransomware by using trustworthy anti-malware software and a helpful guide below |
| System Repair | Use the FortectIntego system repair tool (or similar apps) to fix any damage that the system files and settings sustained |
Ransomware isn't a newly created cyberthreat as it's been around for decades.[2] Since then, it has evolved into an extremely hard to detect, persistent, hard to decrypt, easily delivered strain of malware that's use is increasing year after year.
Djvu family ransomware has also evolved since it was first spotted. To mention one example, cryptoviruses from this lineage were used to encrypt all personal data on the victims' computers by using the AES coding algorithm. The latest versions use the RSA method. And those new variations are popping up each week. Here's a few examples of them:
Within the ransom note cybercriminals state what happened to the victims' computers and what do they need to do to get back access to their files. The purpose of the note is to convince the victim to buy the decryption software, i.e., meet the demands by paying the ransom.
And the threat actors behind ransomware are trying their best to do that – they offer to send one file to them for free decryption and even provide a link to a video where the decryptor is seen in action. Moreover, they offer a 50% discount for the ransom amount if the victims contact within 72 hours of the attack, which lowers the price from $980 to $490.
The developers of the Wbxd ransomware virus send this message to their victims within the _readme.txt ransom note:
ATTENTION!
Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-EtT4dX8q3X
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:
helpmanager@mail.chReserve e-mail address to contact us:
restoremanager@airmail.ccYour personal ID:
–
The convincing techniques are used so the victims would jump to rash decisions and pay their assailants to get their sensitive files back. But by doing that, ransomware victims are encouraging cyberthieves to intensify their attacks and provide funds to develop more advanced ransomware.
The best way to stop cybercriminals from distributing their malicious software is by not paying them. So the greatest choice that a victim can make is to remove ransomware from all infected devices, no matter how small the ransom amount may seem.
If you had an anti-malware tool, but the cyber infection bypassed its security filters, that could mean one of two things, either its virus database was out of date, or it's too weak to catch the latest infections. We recommend using trustworthy apps such as SpyHunterCombo Cleaner or MalwarebytesMalwarebytes for Wbxd ransomware removal.
We're afraid that's not all. To ensure that the virus is completely eliminated, the system files and settings are fixed, and there's no chance of infection renewal. We recommend performing an entire system scan with powerful system repair apps like the FortectIntego. Then you can try to recover those files safely. If you skip these removal steps, you might suffer from secondary ransomware encryption.
The more advanced encryption processes, the fewer .wbxd file recovery options
Djvu ransomware family that its threat belongs to recently managed to alter and improve the encryption procedures and employed a more advanced RSA algorithm started to use online keys exceptionally. Offline keys and victim IDs were also used before 2019, but such methods allowed researchers to recover victims' files entirely.
Developers of this malware now rely on online keys that get uniquely formed for each victim. It is impossible to obtain decryption keys needed for separate devices that get encrypted, so researchers cannot help Wbxd file virus victims as they were with earlier variants in the family.
Options for file recovery are limited, but it is possible to restore at least some of your files. In such instances, users understand the importance of backing your files on separate devices or cloud databases. If you have copies of those files, you can easily replace the affected data with safe copies after the thorough system removal.
Remember to clear the machine from any malware pieces before entering the different device to your computer. You can store some of the encoded files and other malware-related files on the external drive and hope for the future's official decryption tool. However, if you want to use the device right away – anti-malware tools and proper Wbxd ransomware termination are crucial.
Refrain from using file-sharing platforms to avoid Djvu ransomware family infections
It's a renowned fact within the cybersecurity community that the Djvu family spreads its viruses mostly (but not exclusively) through file-sharing platforms, such as popular torrent sites and similar. Until people decide to stop downloading pirated programs, and other illegal software, that won't change.
It's one of the easiest infection payload file delivery methods because the threat actors don't have to hack any websites or devices. Cybercriminals have to think of a catchy name, for example, a crash for the latest, most anticipated game, and upload their creations.
Since there are no security protocols that check every uploaded file, their developed ransomware can easily spread around the world without them doing much. To avoid getting your devices, please don't use torrent sites to download any illegal activation toolkits, unlocked commercial applications, or other pirated software.
Remove ransomware virus with our simple instructions
As we've pointed out in the first chapter of this article, paying the ransom only motivates cybercriminals to infect more innocent people with their created malware, so if you were unlucky enough to get your device infected, the only right thing to do is to remove Wbxd ransomware.
But before doing that, victims should consider either using free Emisoft decryption software or copying all their encrypted files into an external, offline storage device. If their free decryptor isn't working, there's always hope that the necessary tool will be created sooner or later.
After either of those options is done, it's time to take on ransomware removal. Manual elimination is possible, but it isn't a walk in the park, so first try using SpyHunterCombo Cleaner or MalwarebytesMalwarebytes anti-malware software. If the virus is persistent and can't be deleted normally, you'd have to do it in Safe Mode with Networking. A detailed guide for that is provided just below this chapter.
When you get rid of the cyber infection from your device, you have to perform a system repair because viruses from this lineage are known to insert themselves into various system settings and files, such as the Windows Registry, host files, and so on.
This way, they prevent anti-malware software from detecting them, making cybersecurity webpages inaccessible to the victims, and other system irregularities. That's why experts[3] recommend downloading the FortectIntego system repair tool and performing a full system scan with it to restore any changes that virus could have caused to the system so you would encounter any abnormal device behavior, such as cyber threat renewal, crashing, severe lag, etc.
Was this guide helpful?
Be the first to comment