Seto – a malicious ransomware strain that ends up on Windows systems through hacked RDPs
Seto ransomware, first discovered by a computer security researcher named GrujaRS, is a malicious version of the Djvu ransomware family that includes multiple operating features. If you are a frequent technology news follower, you should have already noticed that the Djvu and STOP ransomware families have been updated to prevent security researchers from helping people restore their files for free. Seto is one of the first viruses that is using advanced asymmetric encryption[1] to lock files such as pptx, docx, doc, jpg, png, zip, xlsx, xls, etc., and leaves data unavailable for usage. Additionally, it appends the .seto file extension and _readme.txt ransom message that informs users about the successful encryption process.[2] Finally, the victim is encouraged to pay $490 for the decryption tool as a 50% discount from the starter price – $980.
Seto also has interesting distribution tactics. According to experts' reports, this malware is capable of placing itself on the targeted system through a hacked RDP, known as TCP port 3389. In addition, the virus might reside on the machine after downloading some bogus security products such as IOBIT Driver Booster PRO installers, misuse some system or software flaws to end up on the machine or travel through misleading email texts that falsely claim to be from reputable shipping organizations (e.g. FedEx), banking companies, and other firms.
| Name | Seto |
|---|---|
| Type | Ransomware virus |
| Family | Djvu ransomware and STOP ransomware are two families to which Seto malware also belongs |
| Appendix | The notorious malware strain appends the .seto appendix to all locked files and documents that are found on the infected machine |
| Note | _readme.txt is the ransom-urging message where cybercriminals explain all purposes in order to receive the decryption software |
| Price | $490 for the start and doubled if no communication is made between a three day time period |
| Features | Locking files that are found on the infected machine, injecting other malware strains such as the AZORult trojan, deleting Shadow Volume copies, etc. |
| Spreading | RDPs, especially the TCP port 3389, fake email messages from reputable shipping companies, banking organizations, and similar |
| Detection | Try using a program such as FortectIntego for spotting all malicious components that have been placed by Seto virus on your computer system |
| File recovery | Unfortunately, STOPDecrypter does not work with this version. Follow Seto recovery steps from here. |
Seto ransomware is a tricky one also. It gives only three days to transfer the $490 ransom price, or, according to the claims, the price will be doubled and the victims will have to spend almost $1000 to receive the decryption software. However, paying neither price is recommendable as you might find yourself scammed at the very end.
Criminals who use Seto and similar malware for gaining income do not think about the good for other people as if they would have thought about others, none of this attacking activity would have ever started at the first place. Besides, we recommend going to the bottom of the page and viewing possible decryption solutions there. If you ever deal with this malware, note that it will urge for money via this type of text message:
ATTENTION!
Don't worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-yKBR9rlo6R
or
hxxps://gofile.io/?c=blfjRd
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:
gorentos@bitmessage.chReserve e-mail address to contact us:
gerentoshelp@firemail.ccYour personal ID:
–
Seto uses unique keys to lock up all targeted files and leaves them inaccessible for the purpose of receiving ransom payments. According to the criminals, they can be reached in three ways. You can write these people via gorentos@bitmessage.ch, gerentoshelp@firemail.ccc email addresses or via @datarestore Telegram name.
Note that you will supposedly overcome the _readme.txt ransom message planted not only on your desktop but in all other folders that have files with the .seto appendix also. As you can see, Seto ransomware definitely wants to make himself frequently spotted from every direction possible.
We DO NOT recommend agreeing to pay any type of ransom demand as it is a huge number and you face a big risk of being scammed. Even though files that have been encrypted by Seto ransomware are not decryptable yet, you can still try restoring some of the data back to their primary states by following guidelines at the end of this web article.
Continuously, we have searched the web and found out that DrWeb might be capable of decrypting some Djvu ransomware-related files that cannot be reversed by the STOP decryptor. In addition, DrWeb specialists offer a Rescue Pack if the free encryption appeared successful.[3] This package includes a personal decryption tool and 2 years of DrWeb Security Space protection for the price of $150.
However, before you start searching for data restoring possibilities, you need to put the Seto ransomware removal process as your top priority as if you do not get rid of the cyber threat first, file recovery will be useless and your data will remain locked as the malicious code will still be placed on your system and running active.
Seto ransomware is a threat that does not reside just in one place. Usually, malware skaters all around the targeted computer system and leaves bogus products in directories such as the Windows Registry, Task Manager, etc. Such keys and files allow the ransomware virus to execute and run its malicious code.
Keep in mind that you should no try to remove Seto ransomware without any help of automatical software. At least use a tool such as FortectIntego or SpyHunterCombo Cleaner for investigating the entire computer system. Locating malware strains on your computer will allow you to get a better view on which directories need to be fully cleaned.
Be aware that the detection name of Seto ransomware might differ depending on the type of antimalware program that you are using. Here are the detection names provided by some popular antivirus products:[4]
- Trojan.MalPack.GS (Malwarebytes).
- Trojan.GenericKD.41690750 (B) (Emsisoft).
- Trojan.GenericKD.41690750 (Bitdefender).
- Win32:DropperX-gen [Drp] (AVG and Avast).
- Trojan.Encoder.26996 (DrWeb).
Additional harmful features that might be included in the operating module of Seto ransomware
Ransomware infections themselves have a dangerous nature regarding the ability to lock all files found. However, some malware developers find even more ways to use the ransomware for benefiting their own needs. Sometimes, viruses such as Seto ransomware might be two (or more) different malware strains in one package.
For example, it is known that all STOP ransomware variants might distribute the AZORult Trojan horse. Trojan viruses[5] might be used for cryptocurrency mining, data stealing, and money swindling purposes. Also, if infected with this malware, you might face machine damage. So, Seto ransomware might also be one of the distributors of this malicious payload.
In addition, Seto ransomware might be capable of deleting Shadow Volume Copies of encrypted files in order to harden the data recovery process and encourage users to purchase the decryption tool from the criminals. However, do not be frightened as there are other ways how to restore data files without using Shadow Copies.
However, Seto virus, like all other Djvu variants is able to modify Windows hosts file. This is done to ensure that browser apps will not launch any websites or forums that are antivirus-related and the users will not be able to get any help. So, while performing the malware elimination, ensure that the damaged hosts component is also successfully removed.[6]
RDPs, email spam, software/system flaws – the most popular ransomware distribution places
Developers who promote ransomware infections discover various ways to inject malicious payload into the system. In some cases, crooks misuse Remote Desktop Protocol[7], for example, the popular TCP port 3389 by hacking it and forcibly entering the password in order to connect to the hacked machine.
Email spam campaigns are also one of the easiest and commonly used ways to distribute malware and this includes ransomware viruses also. Crooks drop malicious payload to random users inboxes or spam sections and leave a questionable executable, JavaScript, PDF, or Word file attached to the message.
According to LesVirus.fr experts,[8] this is the place where the virus is located. If the user tends to open or download the file, he/she launches the malicious payload straight onto the system. Bad actors pretend to be from reputable banking companies, shipping firms, and similar organizations.
Try not to get tricked by reputable-looking messages and always verify your expectations of receiving particular emails. Last but not least, the malicious payload can be carried straight to the system through software or computer flaws that allow hackers to enter the machine without big effort. Also, reports claim that crooks manage to inject the malware by using IOBIT Driver Booster PRO installers and similar bogus products.
Our point would be to always be careful while completing computing or browsing actions as danger might be hiding anywhere. However, you should not go without help from reputable antimalware software. Choose a trustworthy antivirus tool that will protect your system and its components daily.
Seto ransomware removal steps for every user
The best way to remove Seto ransomware is by employing specific security tools. Do not try to get rid of the cyber threat by your own as you might end up with only more damage or just not be able to eliminate the virus entirely. Antimalware software that is chosen properly will ensure that the entire process is completed with the best care and that all malicious strains vanish at once.
After the Seto ransomware removal process is finished, you can continue with the data recovery steps that we have provided below. In addition, we want to inform all users that DrWeb might have a chance of decrypting some files, so you can try using their services also. For example, the company offers to purchase their Rescue Pack which includes a personal decryptor and two-year computer protection for $150.
Additionally, you need to make sure that such encryption does not repeatedly happen in the future. For this purpose, ensure that you store copies of important documents on a remote server such as iCloud[9] or Dropbox. Also, you can keep your files safely on a USB device and prevent Seto ransomware and similar malware attacks.
Visual guidelines to help you get rid of Seto faster
We also have created a video-based removal process for Seto ransomware that should help users who like to watch things being done step by step. 2-spyware computer specialists have made the visual material look as simple as possible and help to guide you through the entire task. Down below you will find the video clip:
Did this guide help?
Be the first to comment