What is Sequre Ransomware?

Sequre Ransomware, a virus written in C# programming language encrypts the stored data using AES scripting algorithm.The compromised data is renamed using the hex code pattern <sequre@tuta.io>

For instance a file named “picture.jpg” would be renamed to <sequre@tuta.io_765….> which is completely unusable.

Once the data is encrypted, an HTML executable file “HOW DECRIPT FILES.hta” is generated, and a copy of each is placed in every infected folder as a ransom note.

How does the Ransomware work?

Unlike other ransomware, Sequre encrypts the executable programming code itself rather than the data. So, when Sequre is infiltrated, full code is decrypted, compiled, and executed directly in system memory. This allows Sequre to bypass system security software (anti-virus/anti-spyware suites, etc.)

The victims are informed about the encryption through an HTML file which contains a ransom message stating that a unique decryption key is required to restore files. Victims are entitled to pay a ransom of 0.14 Bitcoin (BTC) which is equivalent to $1280 to get the decryption key which is hidden in another remote server. After submitting the payment, users are required to send a screenshot of the payment made (via email) as a proof.

To be assured to receive the decryption key,after the payment is made, victims are permitted to send a single file (upto 10MB) which is restored and returned as a ‘guarantee’ to ensure that the decryption is possible and will be received with an additional cost of .01 Bitcoin. However, the users should never agree to pay in any case because the victims are often ignored, once the ransom is paid.

So the best course of action is Sequre removal rather than attempting to recover the files.

How does your system become a victim of this ransomware?

The malware gets infiltrated by some unsafe online conducts such as downloading freebies or visiting malicious sites:

1. Contaminated spam email attachments or malicious links: Spam Emails are delivered with infectious attachments which once opened run commands that downloads and installs the malware
2. Clicking on fake software update tools
3. Accidental click on Suspicious third party download sources(peer-to-peer [P2P] networks, freeware download websites, free file hosting sites and similar) present malicious executables as legitimate;
4. Unprotected RDP(remote Desktop) configuration
5. Mounting infected external drives

How to protect your system from this harmful virus?

1. Never open suspicious attachments (especially if you are askedto enable a macro function) inside emails or click on links.
2. Avoid visiting websites of dubious content, do not click on suspicious ads
3. Finally, download and install security software with real-time protection feature.
4. Maintain regular data backup and store them on a remote server or unplugged storage devices.
5. Use Anti-Virus Protection- We strongly recommend the use of antivirus protection/internet security in your PC like Vipre and 360 Total Security so that it remains safe.

Threat Summary

1. Name: Sequre
2. Browsers Affected:Google Chrome, Internet Explorer, Mozilla Firefox
3. Targeted Operating System: Windows
4. Category:Ransomware
5. Symptoms: User’s files are encrypted, a ransom note demanding $1280 is displayed to decrypt the compromised data.

Steps to be followed to remove the malware from the system

Step A: Reboot your system to safe Mode with Networking

To restart the system to Safe Mode with Networking,  follow the below steps:

Step B: Reboot your system to Safe Mode with Command Prompt

Restart System using Safe mode with Command Prompt

Step C: Restore the system files and settings

Restore your system files and settings

Hits: 13