Geek's Advice

COOS ransomware is a dangerous threat to computers

Coos ransomware is a virtual extortion virus that is part of the infamous STOP/DJVU ransomware family. If a victim opens this malware, it scans the infected system for files to encrypt using RSA algorithm, then mark them with .coos extensions . To illustrate, a file called 1.jpg becomes 1.jpg.coos after the encryption. During the attack, the virus drops _readme.txt notes that demand paying a ransom for the decryption software. The price of the decryption software depends on how fast the victim writes to the attackers. If this is done within 72 hours, the ransom price is $490, otherwise, it rises to $980. The note includes two email addresses as the only contact methods to contact the ransomware developers – helpmanager@mail.ch or restoremanager@airmail.cc. Typically, the attackers provide their cryptocurrency wallet address along with suggestions how to buy Bitcoins.

COOS ransomware typically awaits in illegal torrent downloads, such as software cracks, keygens, and similar activators. The victim downloads such files hoping to bypass the need to purchase program’s license key. After opening a disguised ransomware executable, the series of events happen:

• The ransomware attempts to connect to its Command&Control server and based on success decides whether to use online or offline key.
• Ransomware scans computer system, encrypting files in every folder with RSA algorithm and adding extensions based on the virus’ name. During this procedure, the malware drops _readme.txt in every affected folder.
• Next, the ransomware runs several command line commands to delete Volume Shadow Copies from the system, thus getting rid of this data recovery option.
• The virus then alters Windows HOSTS file by inserting a list of domains to it. As a result, these websites become unreachable from the host (computer), no matter what browser is used. It is believed that virus’ developers seek to prevent victim from accessing computer security related domains.
• Finally, the ransomware installs password-stealer named AZORULT.

How the virus chooses encryption key

After being executed on victim’s computer, COOS ransomware attempts to use host’s network connection to reach the Command&Control server. If the connection succeeds, the virus requests a unique encryption key for the computer. In this context, we’ll call this an online key. It is a RSA public key, which is used to lock all files on the PC. To recover files, a RSA private key, also known as the decryption key, is required.

However, sometimes the virus cannot connect to the C&C server (it can happen for various reasons, such as poor network connection, server down during the time of connection and similar). In such case, the virus uses else function and decodes in-built encryption key instead. In this context, it is called the offline encryption key. The main difference between online and offline keys for one virus’ version is the fact that all victims of offline encryption can use one and same decryption key, while victims of online encryption are subject to unique decryption keys only.

You can check whether your version is decryptable and which encryption type you’re affected with by following instructions in this STOP/DJVU decryption/repair guide.

Criminals behind COOS ransomware make your files inaccessible for only one reason – they want to extort you financially. They know that they have corrupted your work or study files, or important and valuable memories such as family photos or videos, so they are going to ask you to pay large sums for data decryption. However, cybersecurity professionals do not recommend paying ransoms to criminals.

_readme.txt serves as a message from the criminals

_readme.txt is a text file created by the ransomware that introduces the attackers’ intentions. The note says that all files, such as photos, videos, documents and archives have been encrypted with strongest algorithm. As the note suggests, the only way to decrypt .coos files is to pay a ransom to cybercriminals.

The note suggests testing the file decryption tool on one file. However, the crooks are not going to provide you with tools so soon – so they ask you to send one small encrypted file to them for test decryption. They promise to send a decrypted file version back. In order to reach the criminals, the victim has to write to helpmanager@mail.ch or restoremanager@airmail.cc and insert personal ID in the message subject (so that the criminals could identify the victim).

The note also informs that the ransom price depends on how fast the victim decides to listen to criminals’ demands. If the victim writes to the attackers within 72 hours (3 days) from the infection timestamp, the ransom price is $490. If the victim fails to pay within 3 days, the price rises to $980 (the full price, according to the note).

It is never recommended to pay a ransom. No matter which cybersecurity expert you’ll contact, the answer is going to be the same (most likely). There are many reasons not to pay, including:

• The attackers might disappear and never reply after receiving the ransom.
• The decryption tool might be faulty and not work properly.
• If you transfer money to virtual attackers, you will support the whole cybercrime industry and help to keep it running.
• Remember that ransom payments are illegal in specific countries.
• Remember that this virus dropped password-stealer on your system, which means that you will be scammed financially (most likely). Do you really want to waste more money on these scammers?

DO NOT PAY THE RANSOM. Try the recommended decryption/file repair tools listed below.

COOS is the 275th extension variant of STOP/DJVU malware gang that has released viruses such as QLKM, BOOA, IGDM, NOBU, EPOR, OMFL. The version you’re infected with is known as the “new” variant, which is harder to decrypt.

Computer users who were hit by this ransomware are advised to remove COOS ransomware virus as soon as possible. To repair virus damage, we suggest downloading RESTORO and performing full system scan.

You must change all your passwords after malware removal procedure (due to AZORULT activity on the system).

Primary ransomware infection vectors

COOS ransomware primarily spreads via infected torrent downloads including software cracks and keygens. These are usually accessible via peer-to-peer download agents, such as uTorrent. Another success factor is that many computer users ignore antivirus or anti-malware software alerts about possibly malicious crack and open it anyway.

Many people head to these free file sharing sites because they are willing to save money. Unfortunately, this typically leads to even bigger financial damage because malicious programs distributed via such downloads either ask for large ransoms for data decryption, or function as a banking information stealers that can empty your accounts or even perform transactions using your login credentials.

According to user reports, the majority of them downloaded this ransomware alongside Adobe Photoshop crack or KMSPico. Most of them report searching for such torrents online. Therefore, if you’re willing to get access to these programs/OS licenses, head to their official distributor’s website instead.

Ransomware is also commonly distributed via email spam campaigns. The attackers typically pretend to be sending an invoice or missing payment information for the victim, asking to open attached contents. These attachments are usually in .img, .ace or .pdf formats.

Moreover, crooks like to exploit the whole online shopping concept during these pandemic times as more people shop online than usual. Such emails include a link asking to track parcel, which can lead to malware or a phishing website.

General tips to avoid ransomware infections

• Be extremely careful if you use peer-to-peer download agents to download torrent-based files. We also advise staying away from illegally distributed and copyright-protected content, such as cracked software versions.
• If you decide to download something from online, scan it with anti-malware and DO NOT IGNORE its alerts if it displays any.
• Be careful when checking your email. Avoid spam folder and do not open attachments or links in even slightly suspicious emails. By suspicious, we mean emails that you did not expect to receive, or that include grammar errors, or their design seems off, links are shortened, and you can feel that message urges you to open attached contents. Criminals can inject malicious code into many file formats nowadays, for example, .img, .pdf or .docx. While the file itself isn’t malware, it can function as a helper that contains a script to download the payload from external source and executes it on your computer.
• Backup your files regularly and frequently. Use external data storage device to store them.

Remove COOS ransomware virus and decrypt files

The primary task you need to do is to remove COOS ransomware virus and related malware from the system. After doing so, you will be able to securely perform other actions such as securing your passwords and try data recovery tools. We have prepared in-detail instructions how to remove the virus from the system. We also advise scanning with for virus damage removal.

As soon as the COOS virus removal is complete, head to the decrypt .coos files section and try Emsisoft’s tool for STOP/DJVU-affected file recovery. Moreover, you should read full guide for file decryption/repair. Finally, report cybercrime incident via given authority pages or use directions to find the one for your country.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.