0

Guys hello. One of my friend laptop get infected with STOP ransomware, all files are encrypted with .mosk extension.The admin account of machine is also compromised, we tried to install emisoft decryptor in the machine, but unfortuantely it's not allowing to install anything as the admin account is managed by attacker. However we have created another user account granting super admin access to it. But still i can see files stored in drives are with .mosk extension. So my question to all of you is that if we connect to internet for any analysis then it might get propagate to this account as well. So what should we do reset the machine?(All files will get deleted then, any option somehow that we can decrypt those files and ransomware can be removed?). Sorry for any typing mistake. Your valuable feedback will be appreciated.

1

First thing I'd do is create a (for example) Ubuntu Live USB on a separate machine and boot that. The ransomware won't work on a Linux operating system, and you can access your hard drive. The files will still be encrypted, but for starters you gain control of the system while cutting the attacker off. You can then recover unencrypted files that have not yet been affected, if there are any.

Next, google reveals a helpful guide regarding the ransomwhere in question:

When it scans your computer for target files, it attempts to establish a connection with its remote server, which generates and sends an online key to encrypt data. If the connection is not available or gets lost, an offline key is used then. In the future, the offline key might appear and you will be able to recover your files.

You can determine if your files were encrypted with the offline key if your personal ID ends with t1. Otherwise, it means that an online key was used, and there are no chances to decrypt your data.

There is a tool called STOP DJVU Decryptor (can be downloaded) - disclosure, I have no experience with the same. With the .mosk extension, it appears you will only be able to decrypt your data if you are lucky enough that it was encrypted with an offline key. More info here

You can determine if your files were encrypted with the offline key if your personal ID ends with t1

Regarding the removal of the malware:

the easiest way to uninstall such type of a computer virus is to use a reliable antivirus program.

  • Thanks@ig-dev. Regarding decryptor tool, we are unable to install it as the admin account is compromised. Seems like we can boot any USB drive on any separate machine like you mentioned. But is there any chance that files can be decrypted, as it contains sensitive details. – Benz Nov 12 '19 at 10:39
  • It depends on your case. The linked resources include instructions. – ig-dev Nov 12 '19 at 11:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.