Assigned STOP/DJVU ransomware .cuag

[Andyrif]

My computer was infected with a virus less than 48 hours ago, which changed all of my files to ".cuag," which I tried to recover in many ways but failed to do because it was an online variation of ransomware. Can someone assist me in regaining access to my files?

 

[struppigel]

I am Karsten and will gladly help you with any malware-related problems.

Please familiarize yourself with the following ground rules before you start.

• Read my instructions thoroughly, carry out each step in the given order.
• Do not make any changes to your system, or run any tools other than those I provided. Do not delete, fix, uninstall, or install anything unless I tell you to.
• If you are unsure about anything or if you encounter any problems, please stop and inform me about it.
• Stick with me until I tell you that your computer is clean. Absence of symptoms does not mean that your computer is free of malware.
• Back up important files before we start.
• Note: On weekends I might be slow to reply

-------------------------------------------------------------------

The file extension .cuag has been used by STOP/DJVU ransomware. STOP/DJVU ransomware variants after August 2019 are only decryptable if an offline key was used. For variants with an online key you cannot decrypt but repair certain file types.

Please upload an encrypted file and a ransom note to id-ransomware to confirm that it is indeed STOP/DVJU ransomware. Tell me the result.

 

[Andyrif]

I am Karsten and will gladly help you with any malware-related problems.

Please familiarize yourself with the following ground rules before you start.

• Read my instructions thoroughly, carry out each step in the given order.
• Do not make any changes to your system, or run any tools other than those I provided. Do not delete, fix, uninstall, or install anything unless I tell you to.
• If you are unsure about anything or if you encounter any problems, please stop and inform me about it.
• Stick with me until I tell you that your computer is clean. Absence of symptoms does not mean that your computer is free of malware.
• Back up important files before we start.
• Note: On weekends I might be slow to reply

-------------------------------------------------------------------

The file extension .cuag has been used by STOP/DJVU ransomware. STOP/DJVU ransomware variants after August 2019 are only decryptable if an offline key was used. For variants with an online key you cannot decrypt but repair certain file types.

Please upload an encrypted file and a ransom note to id-ransomware to confirm that it is indeed STOP/DVJU ransomware. Tell me the result.

Hi, thanks for answering.

I've uploaded the file to find out as you said, and I've also done as suggested, but to no avail because it asks for offline decrypt.

 

[struppigel]

Unfortunately your variant of STOP ransomware encryption cannot be decrypted without a key.

Your options without a backup:

1) Recovery: If you got ZIP archives that were encrypted by STOP, you can still retrieve parts of their contents. If you use file cloud services like Dropbox or OneDrive, those provide a file version history and might be able to restore previous versions of your files.
In rare cases ransomware fails to delete shadow volume copies or fails to delete the original files properly. You can try to recover files via shadow volume copies and file recovery software.
2) Repair: Certain file types, mainly video and audio files, can possibly be repaired with tools like MediaRepair. But these files will loose some data.
3) Wait: Backup encrypted files and a ransom note and wait in case a solution comes up later. Maybe law enforcement gets hands on the keys or the criminals publish the keys as it happened with, e.g., GandCrab. I suggest reading the news on this. Emsisoft will update their decrypter if that happens.
4) Pay: There is the option of paying the criminals, but we highly recommend against this step. You will just fund later attacks. You may also pay without getting your files back. These are criminals and as such not trustworthy.

Please let me know you want assistance in any of the mentioned options above.

Furthermore, I recommend that you apply STOP vaccine to prevent future STOP infections from encrypting your files.

 

[Andyrif]

Unfortunately your variant of STOP ransomware encryption cannot be decrypted without a key.

Your options without a backup:

1) Recovery: If you got ZIP archives that were encrypted by STOP, you can still retrieve parts of their contents. If you use file cloud services like Dropbox or OneDrive, those provide a file version history and might be able to restore previous versions of your files.
In rare cases ransomware fails to delete shadow volume copies or fails to delete the original files properly. You can try to recover files via shadow volume copies and file recovery software.
2) Repair: Certain file types, mainly video and audio files, can possibly be repaired with tools like MediaRepair. But these files will loose some data.
3) Wait: Backup encrypted files and a ransom note and wait in case a solution comes up later. Maybe law enforcement gets hands on the keys or the criminals publish the keys as it happened with, e.g., GandCrab. I suggest reading the news on this. Emsisoft will update their decrypter if that happens.
4) Pay: There is the option of paying the criminals, but we highly recommend against this step. You will just fund later attacks. You may also pay without getting your files back. These are criminals and as such not trustworthy.

Please let me know you want assistance in any of the mentioned options above.

Furthermore, I recommend that you apply STOP vaccine to prevent future STOP infections from encrypting your files.

1. Unfortunately I don't have a copy of the file in the cloud service.

2. I just tried it but failed.

3. If possible, I can wait. But I hope to always get updates from here.

4. No! I will never want to pay.

A little information, all the files that are encrypted are on an external hard drive, but on my device they are all safe. But I have reset my laptop to initial settings (not reinstall windows). Possibly all viruses are now gone, because I have scanned regularly and repeatedly using Windows Defender and Kaspersky Total Security. Now, my laptop is running normally, only the external hard drive and all its contents are still a problem for me.

 

[struppigel]

Unfortunately there is nothing more I can do to help you at this point.

 

[Andyrif]

Unfortunately there is nothing more I can do to help you at this point.

OK. So far thanks for being willing to help me. I hope if then there is a solution to be able to restore my files please let me know, I will keep waiting.