Geek's Advice

MAAK ransomware aims to lock your files using encryption

MAAK ransomware is a highly destructive computer virus that belongs to the STOP/DJVU ransomware group. This malicious program is known to encrypt every available file it can find on compromised computer and also append .maak extension to each file name for easy identification. Take, for instance, a file formerly known as 1.jpg will become 1.jpg.maak, and the same format will be applied to all others. Same time the attack is going on, the ransomware will also forward ransom notes known as _readme.txt to all the folders. Contained in the notes are messages sent by those behind the cyber-attack informing the victim to contact them and pay a specific amount of money as ransom in exchange for MAAK decryption tool they will promise to deliver.

As already stated, the ransom note will emphasize that MAAK ransomware has succeeded in encrypting the entire database of the compromised computer using a sophisticated encryption key.In order to restore files, a matching decryption key is needed, however, it can’t be easily guessed or brute-forced. Therefore, the only way out for the victim, if they hope to recover their files, will be to pay ransom to the cybercriminals. Also enclosed in the message are two email addresses (support@sysmail.ch and helpsupportmanager@airmail.cc) the victim will be expected to use in communicating with them.

The note will also mention the specific amount to be paid by the victim as well as the terms of payment attached to it. In order to pressurize the victim to pay without delay, they will give a condition that if the victim could comply within 72 hours i.e. 3 days, they would be entitled to a 50% ransom fee slash, in other words, instead of having to pay $980, they would pay only $490. However, failure to pay within the given time means only the full amount will be acceptable.

If the victim commences discussion with them, they will further instruct him that payment can only be made with cryptocurrency. The victim would have to purchase cryptocurrency that is worth the ransom fee and transfer it to their wallet address. They usually use such medium simply because of the anonymity it gives thus preventing any chance of being tracked down and arrested. To impress the victim about their expertise, they may suggest for an excerpt of the encrypted file to be sent to them for test decryption.

Nevertheless, our in-house cybersecurity experts strongly advise against any form of ransom payment, no matter the pressure. Other reputable cybersecurity experts, including the FBI, also belong to this school of thought. There are different reasons why victims are cautioned against paying ransom to cybercriminals, and they include the following:

• There is no guarantee you will recover your lost data even after paying ransom to the cybercriminals.
• The more victims pay the ransom, the more cybercriminals increase in numbers and attack even more people.
• There is a high chance you will be given fake decryption tools or totally ignored once you pay ransom to cybercriminals.

In addition, the malware equally releases Trojans such as VIDAR and AZORULT on the already compromised computer to covertly steal vital personal information like banking details, software account login details, browsing history, cryptocurrency wallets, and passwords, among others. Obtaining of such sensitive data may also be used for stealing or blackmail purposes.

Victims of this STOP/DJVU variant should hasten up and remove MAAK ransomware virus as soon as possible. This can be done with the use of any strong and updated antivirus software. However, it is also important to use Safe Mode with Networking option because it will open up your computer system and enable the antivirus to detect and completely remove all trace of the virus. Our team recommends a well-reviewed software for malware removal and computer protection – INTEGO Antivirus.

As an additional step, we advise downloading this tool – RESTORO to identify virus damage on Windows OS files. The full software version repairs damaged Windows OS files without the need to reinstall the operating system.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Ransomware distribution techniques you need to know

In terms of numbers, the majority of computer users become victims of STOP/DJVU ransomware variants, including MAAK virus, after making downloads from malicious torrents. Cybercriminals make use of pirated software copies as bait in those online torrents platforms and those trying to download fake generators or “cracks” end up becoming victims. Data gathered over the years have shown that deceptive “cracks” and other fake license activation tools rank high among those often used. Listed below, in no particular order, are some of the cloned software copies cybercriminals often upload to online torrents platforms:

• KMSPico (illegal Windows activation tool).
• Cubase;
• Tenorshare 4ukey;
• AutoCad;
• Opera browser;
• Corel Draw;
• VMware Workstation;
• Fifa 20;
• Adobe Illustrator;
• League of Legends;
• Internet Download Manager;
• Adobe Photoshop.

At this point, it has become quite clear that going to software torrents online for the purpose of downloading software is a dangerous activity. Some people find it attractive to search for free torrents online for software downloads because they feel it offers software content at very little or no costs, but doing so can be likened to stealing since you’re illegally obtaining copyrighted software content. Therefore, aside from the risks of becoming a victim of ransomware, you could also be prosecuted on the grounds of copyright infringement which is a punishable criminal offence. Instead of passing through such landmines, it is a lot more convenient and risk-free to visit the official platforms of original software developers or their endorsed third-party agents and pay the required fee to obtain it legally. The token you pay will help the industry to grow and it is nowhere near the outrageous ransom cybercriminals ask their victims to pay and neither will you lose your sensitive/vital data.

Another popular ransomware distribution method computer users should avoid is malicious email attachments. In this method, cybercriminals would create highly believable messages and also attach well-designed documents using formats such as DOCX, PDF and XLS. They make use of these particular formats because they enable JavaScript and macro functions that could be released externally as payload on other computers.

To worrisome aspect of it is the fact that it’s becoming increasingly difficult to ascertain whether an email is genuine or coming from cybercriminals. These guys not only impersonate popular corporate brands like DHL, Amazon or FedEx among others but will also mirror their emails like those emanating from these companies. They will equally give it compelling names like Order Summary, Invoice and Tracking Details etc. On the other hand, they may even decide to obfuscate the actual email sender’s address using email spoofing techniques. Based on this, you’re advised to treat with caution, and if you consider an email to be suspicious, it is better not to open it.

Victims of STOP/DJVU ransomware should be wary of any website claiming to offer decryption solutions because such rarely exist. Trying to use any of these fake STOP/DJVU decryptors can cause further damage like the spread of other ransomware variants such as ZORAB. Downloading them may lead to double encryption of your files.

Technical details about the virus

Some victims have wondered about the extent of damage that may have occurred to their computer during the MAAK ransomware attack, and this section will explain it in detail. The first thing a malware does after infecting a computer system is to establish [4 random-characters].exe, build.exe or build2.exe executables and would follow it up by setting up winupdate.exe i.e. the prompt that displays dummy Windows update screen.

It then makes a connection with https[:]//api.2ip.ua/geo.json and saves the result in geo.json file. After that, it will commence information gathering on every detail concerning your computer, including its time zone, geolocation, zip code, longitude and latitude and other relevant data. All these details would be sent to their database. The image below is a good example of geo.json file.

The malware also takes a snapshot of victim’s desktop, and creates information.txt file which comprises computer’s hardware details, installed software list and active processes. Both files will be sent to the attackers’ Command&Control server. You can see a screenshot of this file down below.

By making use of the computer’s geo-location, the ransomware will profile it against their own list of selected encryption-exempted countries (Belarus, Russia, Syria, Kazachstan, Kyrgyzstan, Armenia, Ukraine, Uzbekistan and Armenia). If it indicates positive to any of these countries, the ransomware will immediately stop any further action. However, if it shows negative, it means the coast is clear for a ransomware attack, and it will fully commence it by fetching an online encryption key from their central server and would compile it with the victim’s ID before eventually sending them to bowsakkdestx.txt file and also to PersonalID.txt file for safekeeping.

The screenshot below depicts an example of these files.

If by any chance the malware fails to extract an online encryption ID, it will automatically resort to the use of an offline encryption ID. The difference between the two is that while online encryption ID is unique/distinct for every victim, offline encryption ID on the other hand, is a one-size-fits-all given to every victim of a particular ransomware variant. The implication is that unlike online encryption ID, an offline encryption ID increases the chance of a successful decryption of .maak files from now on. To detect if an offline key was used in encrypting your data, check to see if there are t1 characters appearing at the end of the personal ID created for you. More information about this is provided below the article or in this detailed guide.

The ransomware will at this point commence full data encryption by scanning all folders and encrypting them with Salsa20 before using RSA-2048 key to lock the encryption. While this is ongoing, it will mark the files with additional extension which distinguishes this specific malware variant.

The image below shows a screenshot of _readme.txt ransom note the virus leaves in all the folders.

The next thing it does is to delete Volume Shadow Copies using the Command Prompt task as shown here:

^{vssadmin.exe Delete Shadows /All /Quiet}

In completing the circle, the virus will compile names of some domains and will forward them to the Windows HOSTS file and attach them to the localhost IP. It takes this step in order to effectively prevent the victim from having access to those blacklisted sites where they could get help online. Any attempt made to reach them will bring up a DNS_PROBE_FINISHED_NXDOMAIN error message.

Remove MAAK Ransomware Virus and Recover Your Files

We advise victims of ransomware attack to remove MAAK ransomware from their computer as quickly as possible and also report the incident to the local office of any government law enforcement agency responsible for taking care of such issues.

For a more detailed approach, please consider taking the steps outlined below:

• Initiate MAAK ransomware virus removal without delay using strong antivirus software.
• Reach out to the relevant government law enforcement agency nearest to you and report the situation.
• Make use of your back device to restore lost data.
• Change all passwords that were directly or remotely used on the compromised computer.
• Consider going for tutorials to understand if/how STOP/DJVU variants affected data can be decrypted or repaired.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.