Remove COOL Ransomware Virus (DECRYPT .cool FILES)

COOL ransomware encrypts personal files on a computer and marks them with new extensions

COOL ransomware is a malicious computer virus originating from STOP/DJVU ransomware virus family. This virus aims to encrypt all files on the target computer and while doing it also appends .cool extension to their filenames. To illustrate, a file originally named 1.jpg becomes 1.jpg.cool after being infected. To inform the computer owner about the ransomware operators’ intentions, the virus drops _readme.txt note in all affected folders. The note suggests that the only way to get COOL file decryption tool is to pay a large ransom to cybercriminals.

The ransom note dropped by COOL ransomware suggests that the victim can still return all files. It also explains that all data including pictures, videos, databases, documents and other file formats have been encrypted with the strongest encryption algorithm and unique key. Although not mentioned in the note, the virus uses Salsa20 + RSA-2048 bit encryption type. The note instructs the victim to contact the criminals via provided email addresses: manager@mailtemp.ch and supporthelp@airmail.cc.

The note suggests that the victim should rush to contact the criminals within 72 hours to get a 50% discount on the decryption service price. If the victim does it, the criminals are willing to set the price to $490. If delayed any longer, the ransom price would be $980 instead. The note also says that the victim can attach one encrypted file that doesn’t contain no valuable information to test the decryption – the attackers promise to send a decrypted test file in return.

After writing an email to the criminals, the victim gets instructions to purchase cryptocurrency such as Bitcoin worth the ransom amount and how to transfer it to the attackers. The crooks usually provide several links to websites that can be used to purchase virtual currency. The reason why such Internet criminals want to receive the ransom in this way is because it helps them to stay anonymous and thus law enforcement agencies have no power to track the parties between such transactions.

Geek’s Advice experts suggest following FBI recommendations about paying up to cybercriminals – DO NOT PAY THE RANSOM. First of all, paying a ransom does not guarantee successful file decryption. Another reason why it is wrongful to do so is because money is the fuel behind these illegal operations as it allows the attackers to employ more malware developers or distributors and therefore infect even more victims worldwide with more sophisticated threats. Criminals behind file-encrypting malware earn millions annually already, which is another factor that lures other people to become affiliates in this fraudulent business.

Another reason why you shouldn’t pay these people is because the ransomware you were infected with has a tendency to drop additional information-stealing Trojans such as AZORULT or VIDAR on infected system. These viruses are capable of allowing criminals to run commands on your computer remotely to steal private details such as browser-saved account passwords as well as login credentials for various applications (Steam, Telegram and others), Skype chat history, cryptocurrency wallets and more. Therefore, even if you pay, the attackers can continue to blackmail you and ask for more money or log into your accounts and cause further damage.

Victims infected with this ransomware variant are advised to scan their computers with robust and up-to-date antivirus software immediately. This should be done while in Safe Mode with Networking as explained in the removal guide below. If you do not have an antivirus software yet, our team strongly recommends using INTEGO Antivirus to remove COOL ransomware virus and related malware. On top of that, you may want to download RESTORO to scan for virus damage on Windows OS files and repair it.

Ransomware Summary

REPAIR VIRUS DAMAGE

Avoid ransomware infections: learn how these viruses are distributed

It is well-known fact that STOP/DJVU virus versions such as COOL extension virus are distributed via malicious torrents downloads, mostly ones that are supposed to activate paid software versions illegally. Some examples of torrents that can land you this virus on your computer are software cracks, keygens and other tools like KMSPico. Victims of this ransomware strain report getting infected after downloading pirated torrents for these popular programs:

• Adobe Photoshop;
• Fifa 20;
• Tenorshare 4ukey;
• AutoCad;
• Corel Draw;
• Opera browser;
• VMware Workstation;
• Cubase;
• League of Legends;
• Adobe Illustrator;
• Internet Download Manager.

You should avoid heading to various online torrent listings for obtaining programs. Instead, you should visit official developer’s or verified partner’s website for a legitimate copy of the software or game that you’re interested in. Trying to get these things for free can only lead to a severe computer infection and immediate data loss. Besides, doing so is an infringement of legitimate software developers’ copyrights.

Ransomware-type viruses are often distributed via malicious email spam (also known as malspam). The malware gets hidden in files attached to such emails and they can come in popular file formats such as DOCX, PDF, XLS and others. The criminals complement these documents with JavaScript or Macros that, once run, can download the payload from a remote source and launch it on your computer.

Nowadays, advanced cybercriminals rarely make obvious mistakes when sending malicious spam – they hardly ever leave grammar errors or weirdly placed company logos in their emails. They can even spoof the sender’s email address to make it appear like it was sent by an official and well-known sender. Moreover, they might pretend to be your colleague, boss or a company providing services that people user regularly – for instance, eBay, Amazon, DHL, UPS or others. They name the attachments as invoices, order summaries, parcel tracking details and similar, so it can be really hard to identify the malevolent intentions behind them. Our general advice is to avoid opening something that you did not expect to receive, or your curiosity will lead to computer infection. Another tip is to look for unfamiliar greeting line in the email.

Another important ransomware distribution technique is based on fake STOP/DJVU decryption tools. Criminals know that there are hundreds of computer users desperately looking for a solution to decrypt .cool files, so they might upload fake decryption tools promising they can restore your files. In reality, STOP/DJVU ransomware-encrypted files can be restored only in certain conditions explained here. If you try to search for tools that simply do not exist, you might end up infecting your computer again and your files might get double-encrypted. One of ransomware strains that’s been distributed as a fake decryptor is called ZORAB.

More about the ransomware activity on your computer

This section contains more technical details about the ransomware if you are interested in more coverage of what actually happened during the cyberattack. After being executed on the target system, COOL ransomware virus begins as a set of processes called build.exe, build2.exe or build3.exe. Each of these processes have a different set of functions. Before starting the actual data encryption procedure, the virus performs a couple of checks and collects as many details about the target computer as possible.

First of all, the virus checks whether the computer it managed to compromise is eligible for encryption. It has a set of exception countries that it is designed not to attack. Therefore, it connects to https[:]//api.2ip.ua/geo.json domain and the response of it is saved into geo.json file. This file contains information about computer’s country code, zip code, longitude, latitude and time zone. The virus then compares the country code received to its exceptions list and if founds a match, it then terminates itself without encrypting victim’s files. You can see an examples of geo.json files below.

The ransomware tends to avoid encrypting files on computers from these countries: Russian Federation, Armenia, Tajikistan, Ukraine, Kazachstan, Kyrgyzstan, Syria, Uzbekistan and Belarus. Otherwise, it continues the attack and prepares for the data encryption stage.

In the next phase, the ransomware attempts to connect to its Command&Control server and get an unique online encryption key for the victim as well as identification string. The response is then saved to bowsakkdestx.txt file and personal ID is saved to PersonalID.txt file as well. If the attempt to obtain online key fails, the virus uses offline encryption key instead. Victims affected by offline encryption type will have personal IDs ending in t1 characters. Users affected by this key have a chance to decrypt .cool files in the future, which cannot be said about online key encryption victims.

The ransomware also collects information about computer’s hardware and software as well as details like user name, operating system and other data and saves it to information.txt file and sends it to criminals C&C server as well.

Finally, the virus begins encrypting victim’s files stored on the compromised computer. The ransomware uses Salsa20 encryption to secure information and then strengthens it by using RSA-2048 key on it. Each of encrypted files will be assigned an additional extension to make it distinguishable.

A screenshot of _readme.txt note which is left in every folder containing affected files is shown below.

To finalise the attack, the malware gets rid of Volume Shadow Copies from the computer by running the following Command Line task:

^{vssadmin.exe Delete Shadows /All /Quiet}

Additionally, some variations of STOP/DJVU viruses tend to add a list of domain names to block on the target host. The ransomware uploads this list to Windows HOSTS file and maps each of them to localhost IP, thus causing DNS_PROBE_FINISHED_NXDOMAIN error to pop-up whenever the victim tries to access one of these. Moreover, some variants we’ve seen infect the already compromised computer with Trojans like AZORULT or VIDAR.

Remove COOL ransomware virus and Recover Your Files

In case you’ve become a victim of ransomware attack, you should contact your local law enforcement agency and let them know about what happened. Next, it is essential to remove COOL ransomware virus as soon as possible, especially when it or related malware can continue dangerous operations on your PC. We have prepared an easy removal guide which explains how to boot your computer in Safe Mode with Networking from which you should run your chosen antivirus software. Before doing so, ensure that you have one on your computer. If you do not have it, consider using INTEGO Antivirus which is highly recommended by our team. It provides real-time protection and network traffic protection, besides, scores excellent malware detection rates in independent AV lab tests.

After removing malware from your computer, you may want to download RESTORO to repair virus-damaged Windows OS files.

If you’ve already taken care of COOL ransomware virus removal, please read these suggestions from our team:

• Use data backup to restore lost files. Before using it, you must remove all malware from the Windows system first.
• Read about ways you can decrypt or repair files affected by STOP/DJVU versions.
• Change your passwords for as many accounts as you used on your computer, including browser saved ones, also Steam, Telegram and other apps.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.