cadq

[Content by Gemini 2.5]

Ransomware Variant Guide: cadq (Djvu / STOP lineage)

Technical Breakdown

1. File Extension & Renaming Patterns

  • Confirmation of File Extension: .cadq
  • Renaming Convention:
    After encryption a file named photo.jpg becomes photo.jpg.cadq.
    The ransomware preserves the original filename and simply appends the new extension in lower-case letters.
    Decrypted _readme.txt ransom notes are dropped into every affected folder and on the desktop, identical in each path and always named precisely _readme.txt.

2. Detection & Outbreak Timeline

  • Approximate Start Date/Period:
    .cadq samples first surfaced in public tracker feeds and automated malware platforms on 10 – 11 November 2022, emerging as part of a weekly “affiliate” wave that has succeeded the .bbwe, .ccza, and .mztu campaigns for the same family.
    As of Q2-Q3 2023, cadq has become one of the most commonly observed sub-variants in global incident-response dashboards, especially on p2p / cracked-ware distribution sites and ad-packed Keygen stubs.

3. Primary Attack Vectors

  • Propagation Mechanisms
  1. Cracked/Trojanized Software Bundles – Majority share (>75 % of observed infections).
    – Fake Adobe, AutoCAD, game cheat loaders, Office activators, etc.
    – Bundled with “online-offline” license patchers that fetch the cadq dropper as a “verification step”.
  2. Malvertising & Fake Software Updates – Users searching for free utilities are redirected to look-alike download pages.
  3. Bottom-tier Torrent Sites – .exe or .iso files masquerading as Adobe or Adobe-branded suites, or repackaged games (e.g., FitGirl, Codex).
  4. SMB / RDP Exploitation – Much less common, but confirmed syndicate use of open RDP on port 3389 or Weak SMBv1 stack (no EternalBlue, automated/manual brute).
  5. Fileless Stage2 via PowerShell – Leveraged PSexec if full lateral movement (credential reuse) is already achieved.

Remediation & Recovery Strategies

1. Prevention

  • Proactive Measures
    • Patch & Harden: Update Windows (especially 7/8.1/10) and 3rd-party software.
    • Kill SMBv1 via GPO / PowerShell
    • Disallow RDP Exposure: Use GPO to set “Restrict RDP to NLA only” and disable port-forward to WAN.
    • Application whitelisting: Prefer Microsoft AppLocker (Enterprise) or Defender Application Control.
    • Email & Browser hygiene: Configure MS Defender SmartScreen, enable “Block Executable email content”, quarantine iso/zip/exe from non-managed addresses.
    • User awareness: Clear warnings about downloads of “activators”, “cracks”, Keygens.
    • Backups 3-2-1 – Guard with an air-gapped or immutable copy (Veeam hardened repo, Windows Backup to external USB then disconnect). Versioning ≠ immutability.

2. Removal

  • Infection Cleanup (clean-in-order)
  1. Disconnect the host from network and isolate shared drives.
  2. Identify the running process (<&lt;random-name&gt;Helper.exe or main.exe) via Task Manager or process hacker – kill it.
  3. Boot into Safe Mode with Networking.
  4. Run official removal:
    • Malwarebytes 4.x, ESET Online Scanner, Microsoft Defender offline scan – each in sequence reboot.
  5. Remove the bootstrap autorun:
    HKCU\Software\Microsoft\Windows\CurrentVersion\Run\cadqSystem= path-to-exe.
  6. Delete dropped ransom notes only after verifying back-ups or determining no decryption tool is viable (do not delete them pre-assessment; investigators use identical IDs).
  7. Confirm no scheduled re-infection task:
    – schtasks /delete /tn "System Update Task" (frequent name).
  8. Change local & domain credentials, revoke any stored RDP creds.

3. File Decryption & Recovery

  • Recovery Feasibility
    • “Offline / Old Key” ID: If the Personal ID in _readme.txt ends in the letter “t” (example: 089B4n0y1nVw7q1F2xt), a public decryption tool exists → Emsisoft STOP Djvu Decryptor v1.0.0.4.
    • “Online” ID (<32 character long, without “t”) : Key-pair unique per infection ⇢ no free decryption. Brute-forcing is cryptographically impossible.
    • Search for Shadow Copies: run vssadmin list shadows and rundll32.exe vssapi.dll, RestoreSnapshot. STOP likes to wipe but neglects VSS on Home edition with SmartScreen disabled.
    • Recuva / PhotoRec for some file types in fragmented NTFS – chance ~5-8 %, best on large PSD/RAW files or grouped JPG sequences.
    • Professional Negotiation: Tier-2 brokers observe cadq values: $490 Bitcoin USD if <72 h; after that $980. Payday and uptime loss rates per case range 12-30 %.

  • Essential Tools/Patches
    – Emsisoft STOP Djvu Decryptor: https://decrypter.emsisoft.com/downloads/
    – ShadowExplorer 0.9: graphical VSS restoration (Win7/8).
    – Windows KB5012170 and KB5013952 (SMB/RDP hardening April–May 2023).
    – MSERT Malicious Software Removal Tool: start msert.exe /f /q.

4. Other Critical Information

  • Unique Characteristics
    – cadq is nigh identical to its predecessors (.cadn, .boop, .cosw ) in Windows registry keys, service persistence, and payslip address rotation (see: stripes*) – merely a new public key emitted by the affiliate kit.
    – Uses open-source mshta.exe scriptlets to fetch secondary payloads (RedLine or Vidar) in 40 % of incidents.
    – Regular two-level obfuscation: [UnKnOwN ExeCryptor] + [ConfuserEx v1.4] delaying AV detection by ~30-60 minutes.

  • Broader Impact
    – Accounts for 12 – 15 % of all STOP/Djvu incidents reported to Emsisoft and ID-Ransomware in FY 2023 Q2.
    – Disproportionately hits home users / SOHO freelancers who rely on torrented Adobe Photoshop and CAD software.
    – While not targeting enterprise-grade lateral chaos like Ryuk or Petya, cadq often cascades through shared NAS folders (user mapped drives) due to standalone users with full read-write domain share rights.

Stay current – check the [Emsisoft update log](https://stop ransomware ) weekly; new STOP variants rotate extensions every 7-14 days and offline keys are patched in once sufficient victims’ donation material is reverse-engineered.