Xxx ransomware (.xxx files): what it is and how to recover

What Xxx ransomware is

Xxx ransomware is a Windows file encryptor from the GlobeImposter family: it adds .xxx to your file names, drops how_to_back_files.html in every folder it touched, and tells you to e-mail the criminals for a price.

The old name "BadJerry" comes from the first contact address in the note. The same .xxx ending has appeared with other addresses, so the extension alone does not say who is behind your infection.

Family

GlobeImposter, a copycat of the older Globe ransomware (Emsisoft, Microsoft)

Extension added

.xxx, after the original name and extension

Encryption

AES for the files and RSA for the AES key, as the family does (Microsoft)

Our first report

9 April 2021

Our 2021 report called the note a "pop-up window"; it is a file, so save it.

How the story went

1. 23 December 2016

   Emsisoft's first decryptor

   Emsisoft's page covers the first version: files ending .crypt. Microsoft dates the discovery to a May 2017 spam campaign; the dates differ, so we give both.

2. 9 April 2021

   Our first report on .xxx

   We described the extension, the HTML note and its two contacts.

3. February 2023

   AhnLab links the family to MedusaLocker

   AhnLab reports MedusaLocker operators spreading it, probably over Remote Desktop.

4. 6 October 2026

   Our recheck

   We cannot confirm that new infections still use .xxx.

What we checked and what we did not

No website is involved and we did not run the malware, so this is a check of sources, and a source check clears nothing.

Is it this one? Four signs to check

Which name will your scanner show?

Microsoft's name for Xxx ransomware is Ransom:Win32/Globeimposter.

Defender sorts threats by category first, so the word before the colon tells you what kind of program was found, even if the family name means nothing to you.

Do not search for a removal tool by the detection name alone; fake "removal tools" use the same keywords. How the naming works is explained in our guide to antivirus detection names.

• Path: 1.jpg.xxx
• File extension: .xxx
• Note file: how_to_back_files.html
• Contact: bad.jerry@aol.com and badjerry@cock.li

One extension, several notes

Our 2021 report showed three notes.

Each lists different contacts, so compare contacts and note name before you look for a decryptor.

Do not write to any of the addresses.

ZXX virus and Xxxvirus: is it the same as Xxx ransomware?

Some people search for a ZXX virus or Xxxvirus.

We found no reliable source for a separate threat called ZXX. Our reading is that it is a slip for Xxx, since the letters are close and the file extension is the same.

Check the facts on your own files. Xxx ransomware renames files with the .xxx extension and leaves a note called how_to_back_files.html. If your files end in something else, the infection is a different family, and the steps for Xxx may not apply.

To identify the family, upload one encrypted file and the ransom note to an identification service for ransomware.

Keep copies of the encrypted files, since a decryptor may appear later.

What it does on the PC

We did not run a sample of this version. The steps come from Microsoft's description of one GlobeImposter variant and AhnLab's analysis of another, so the .xxx version may differ.

1. Start

   Copy and startup entry

   Microsoft lists a copy named svchost.exe in AppData\Local and a RunOnce entry called BrowserUpdateCheck.

2. Start

   Key file

   A file named with a 64-character hash goes into C:\Users\Public; the encryption skips it.

3. End

   Safety nets deleted

   A batch file runs vssadmin.exe Delete Shadows /All /Quiet, clears saved Remote Desktop entries and every Windows event log (Microsoft).

4. End

   The program deletes itself

   So a scan that finds nothing does not mean your files are safe.

Our 2021 guide said the infection can stay quiet while it encrypts; Microsoft lists only a slowdown.

How it reaches PCs

No source documents the delivery of this exact sample.

These are the routes our 2021 guide and the sources name for the family.

• High

  Spam with an attachment

  Fake bills and DHL or FedEx notices with a macro or script; SentinelOne names 2017 waves with 7-Zip archives holding JavaScript.

• High

  Remote Desktop, weak password

  AhnLab ties a recent wave to MedusaLocker operators who log in this way.

• Medium

  Cracks and torrents

  You cannot control what is packed with a crack or keygen (PCrisk, our 2021 guide).

Was anything stolen?

Nothing we read says this note came with data theft, but a person may have been on the PC, so treat passwords as exposed.

• Medium

  Other malware

  PCrisk warns that password-stealing trojans can arrive with ransomware.

• Medium

  Credential tools

  AhnLab found Mimikatz and a port scanner beside GlobeImposter in a Remote Desktop attack; unknown for .xxx.

What a ransom note left in folders said

YOUR PERSONAL ID

YOUR FILES ARE ENCRYPTED!

ALL YOUR IMPORTANT DATA HAS BEEN ENCRYPTED.

To recover data you need decryptor.

To get the decryptor you should: Send 1 test image or text file to BAD.JERRY@AOL.COM and BADJERRY@COCK.LI

In the letter include your personal ID (look at the beginning of this document).

We will give you the decrypted file and assign the price for decryption all files.

Do not attempt to remove the program or run the anti-virus tools

What the note says and what it wants

The note asks for no money at first: it asks for a test file and your ID, and the price comes in the reply.

Can the .xxx files be decrypted?

Probably not for free. A free GlobeImposter tool exists, but it is for the 2016 version, and we could not confirm that it accepts .xxx files.

1. 1

   Copy the files first

   Run nothing on the only copy.

2. 2

   Find an unencrypted twin

   An e-mail attachment, a phone or a cloud copy of one of the files.

3. 3

   Try the tool on a copy

   Drag the pair onto the decryptor; if it refuses, nothing is lost.

4. 4

   Keep the encrypted copies

   Tools and leaked keys are added over time.

Safe Mode and the scan, in order

Removal stops new encryption; it does not decrypt anything, and restored files would be locked again if the program were still there.

1. 1

   Start Windows in Safe Mode with Networking

   Windows 11: Settings > System > Recovery > Advanced startup > Restart now. Windows 10: Settings > Update & Security > Recovery > Restart now. Then Troubleshoot > Advanced options > Startup Settings > Restart, and press 5.

2. 2

   Scan twice with Microsoft Defender

   Windows Security > Virus & threat protection > Scan options: run Full scan, then Microsoft Defender Antivirus (offline scan).

3. 3

   Look for the family's files

   Microsoft lists an svchost.exe in %LocalAppData% for another variant; unconfirmed for .xxx, so treat a find as a lead.

4. 4

   Change passwords from a clean device

   Do this before you reconnect any backup drive.