0

Yesterday, a ransomware hit my PC. I didn't pay the ransom and didn't comply with what the attackers were asking for and I wiped everything and every drive on my PC and then reinstalled my stuff from a backup I made previously so everything is fine. But before I wiped everything, I backed up some of the files that were encrypted by the ransomware to try and analyze them later. Now that everything is working as before, I am interested to know which ransomware infected my PC. In every directories of my computer it created a file named +README-WARNING+.txt which contained the following text:

::: Greetings :::

Little FAQ:

.1. Q: Whats Happen? A: Your files have been encrypted. The file structure was not damaged, we did everything possible so that this could not happen.

.2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay us.

.3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our >interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee.

.4. Q: How to contact with you? A: You can write us to our mailboxes: [email protected] or [email protected]

.5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files.

.6. Q: If I don�t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money.

:::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.

Does anyone recognize this ransomware? I don't see any names in it and therefore I don't know to whom it could belong.

Every file on my system got added .[B4ACABE4].[[email protected]].mkp For example a file named text-file.txt would be named text-file.txt.[B4ACABE4].[[email protected]].mkp after the attack.

The wallpaper was replaced with an image saying that my PC was hacked and I had to pay to get my data back but I didn't see anywhere an executable file to decrypt the files or pay the ransom or anything like that.

Improve this question
0

1 Answer 1

Reset to default
3

mkp suggests that it is Makop ransomware mentioned in CISA's Alert (AA21-287A) from Oct 14, 2021.

In September 2020, personnel at a New Jersey-based WWS facility discovered potential Makop ransomware had compromised files within their system.

According to Digital Recovery

MKP ransomware is a variant of the Makop ransomware, which like other ransomware has strived to create a family/cartel.

and

Makop ransomware has been expanding through its affiliate program, RaaS (Ransomware as a Service), a tactic that aims to seek partners to carry out attacks by only charging a commission on top of the ransom value. This tactic is intended to expand the attacks by bringing renown to the group.

A more technical analysis of Makop ransomware from Tomas Meskauskas (PCrisk.com) shows the similarities despite the extension has been changed with this variant. The letter is identical.

Makop is a type of malware categorized as ransomware. It operates by encrypting data of infected systems and demanding payment for decryption tools/software. During the encryption process, all affected files are renamed according to this pattern: original filename, unique ID, cyber criminals' email address and the .makop extension.

For example, a file named 1.jpg would appear as something like 1.jpg.[EF7BE7BC].[[email protected]].makop, and so on. After this process is finished, a text file named readme-warning.txt is created on the desktop.

There are plenty of variants including:

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .