Sqpc Ransomware
The Sqpc Ransomware is a new variant of the nefarious STOP Ransomware. Many less-experienced cyber crooks opt to base their threatening creations in already existing ransomware threats like the STOP Ransomware.
Table of Contents
Propagation and Encryption
The Sqpc Ransomware is likely distributed via bogus emails that contain corrupted macro-laced attachments. This is a commonly used trick by countless cybercriminals. Usually, the email is designed to trick the user into opening the attached file. Often, the attachment is presented as an important document such as a job offer, bank statement, invoice, etc. Other commonly used infection vectors include:
- Corrupted advertisement campaigns.
- Torrent trackers.
- Fraudulent application updates or downloads.
- Fake pirated copies of popular software suites.
If the Sqpc Ransomware managed to penetrate your system, it would scan it to locate your files. The Sqpc Ransomware is designed to encrypt a large variety of filetypes. The would encrypt all your documents, images, audio files, presentations, spreadsheets, databases, archives, etc. There is a new extension appended to the names of all the files that the Sqpc Ransomware encrypts – '.sqpc.' For example, a file you called 'crystal-grass.mp3' will be renamed to crystal-grass.mp3.sqpc.'
What Does Sqpc Ransomware Do?
Like most ransomware, the virus gets on a computer and locks essential data and files behind a cryptovirus. The infected files have their file extension changed to ".Sqpc" and a ransom note appears on the computer. The ransom note, called "_reame.txt," explains to users that they must pay a ransom of either $980 or $490 if they act fast enough.
Sqpc uses AES-256 bit encryption, meaning that it is impossible to decrypt files without outside interference. There are some variations of DJVU that can be unlocked with a public decryptor, but Sqpc is not one of them. Only ransomware with an offline key can be decrypted through public decryptors, and all variations of Spqc seen so far use online keys.
Ransomware is programmed to systematically disrupt system performance, make targets more vulnerable, and force users to pay a ransom. Ransomware is effectively all the same on a base level. Like other ransomware, Sqpc attacks in stages.
The first thing it does is get into the Windows Startup folder and Windows Registry. This step establishes persistence on the computer. After securing a spot on the computer, it downloads four files – 1.exe, 2.exe, 3.exe, and pdatewin.exe. These files serve different purposes. One is used to stop security software, while the others connect to the C2 server, modify host files, terminate security programs, and perform other essential tasks.
A successful launch ends with all the files on the computer being locked. The virus adds a new file extension to the targeted files. The ransom note appears on the desktop and in folders with infected files. This note explains to users what happened and how they can pay the ransom to get their data back. Criminals say that victims should respond within 72 hours so they can get their data back at half-price for $490 instead of $980.
The Ransom Note
The Sqpc Ransomware would drop a ransom note on the user's computer as soon as it concludes the encryption process. The note is named '_readme.txt.' In the note, the attackers claim that victims need to pay $980 as a ransom fee. However, they offer a 50% discount to all victims who manage to reach them within 72 hours of the attack taking place. The users who meet the deadline would have to pay $490, instead of the full sum. There are two email addresses provided by the attackers – ‘helpmanager@mail.ch' and ‘restoremanager@firemail.cc.'
The Sqpc Ransomware ransom note reads like the following:
ATTENTION!
Don't worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-xcn1Dtzak4
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.
To get this software you need write on our e-mail:
helpmanager@mail.ch
Reserve e-mail address to contact us:
restoremanager@firemail.cc
Your personal ID:
Don’t hesitate to conduct an antivirus scan if you notice any signs of infection on your computers – such as slow performance, unfamiliar programs, and website redirects. The longer a virus remains on your computer, the more damage it can potentially do. Ransomware tends to strike poorly defended PCs most, getting on computers through existing backdoors and unnoticed Trojan infections.
How Does Sqpc Spread?
Ransomware like this can spread through a number of methods. Spam e-mails are the most popular, but it isn’t the only way. The thing to know is that all means to spread ransomware are particularly stealthy and designed to make people fall for their tricks. Here are the most common ways malware is spread;
- Spam e-mail attachments
Spam e-mail attachments are the most common method. Criminals create malspam campaigns and spread spam e-mails using bots. The criminals send out tens of thousands of e-mails in the hope that even a fraction of them will be accessed. The messages are created to look authentic and appear to be from a reliable source. They may pretend to be from government organizations or delivery companies, for example. Either way, the e-mail contains an e-mail attachment or a link for readers to click. Interacting with the link or attachment downloads the payload for the virus on computers.
- Cracks and Keygens
Pirated software is typically bundled with a "crack" or "keygen" to make it work. These cracks are commonly bundled with malicious software that executes when people attempt to access them. This is just one reason to not download illegal software, outside of the fact that it is – of course – illegal.
- Phishing websites
Phishing websites are hacked websites criminals use to spread malware. Just visiting one of these websites can be enough to cause trouble. People are redirected to these websites through suspicious links.
How to Protect Against Sqpc
Sqpc can cause significant losses – both personal and financial. File encryption malware attacks indiscriminately. It targets poorly defended computers to compromise them even further. It attacks startup processes, the Windows registry, and other aspects of the machine to make it run slower.
With that said, the worst thing about a ransomware infection is the potential loss of encrypted personal files. The attackers are only interested in your money; however, paying the ransom is never the right way to handle Sqpc. There is always the risk of permanent data loss and identity theft. Instead, it is best to use security software to remove the virus. If you are lucky enough to have external data backups, then you don’t have to worry about losing your data. If not, then it may still be possible to get your data back.
The most important thing you can do to protect your computer against Sqpc and other threats is to invest in robust security software and keep regular data backups.
