Geek's Advice

MIIA ransomware aims to lock your files and demand a ransom from you

MIIA ransomware is a nascent malicious file-encrypting computer virus that belongs to the STOP/DJVU ransomware family. This virus is known to attack computer systems by encrypting all contained in it while equally appending .miia extension to each filename. For instance, a file originally stored as 1.jpg automatically becomes 1.jpg.miia and the same process is repeated continuously. Same time while the cyber-attack is still ongoing, ransom notification will be dropped through a folder known as _readme.txt, in all the folders. Contained in the ransom message is notification informing the victim on how to pay ransom in exchange for MIIA decryption tool.  

They will further emphasize that MIIA ransomware has encrypted all files (including documents, pictures and every other data) contained in the computer, using very strong encryption key. Therefore, if they hope to recover their files certain amount of money would have to be paid in exchange for decryption services. To facilitate the ransom payment process, the cybercriminals would make available the following email addresses for communication purposes: manager@mailtemp.ch and helpsupportmanager@airmail.cc.

The note will equally contain specific charges and conditions attached with the ransom payment. For instance, the victim would be informed that paying within 72 hours of being notified, would earn them a 50% discount. In other words, they would now pay $490, but if they fail to comply within the first 3 days, the ransom demand will revert to $980 flat rate. 

However, if the victim goes ahead to contact them, he will be told that can only be done with cryptocurrency. So, they will forward a wallet address and instruct the victim to pay the exact cryptocurrency equivalence into it. Obviously, they use such channel because of the anonymity it offers and thus preempt any chance of it being followed by law enforcement agents. In order to convince the victim and influence them into paying the ransom, they may request for excerpts from the encrypted files for them to decrypt as sample.

Nevertheless, cybersecurity experts’ from our company advice that victims of ransomware should not pay ransom, regardless of the situation. Our sentiment is also shared by the FBI that also advice against complying with the demands of cybercriminals. It must be emphasized that complying with their ransom demand does not guarantee you will recover your files, so why pay? In addition to that, always remember that paying cybercriminals such huge amounts of money will only embolden them to continue in their nefarious activities. Worse still, the virus is known to release certain dangerous Trojans in the likes of AZORULT and VIDAR that steals vital information such as banking details, software login credentials, cryptocurrency wallets, passwords saved on browser among others. Such sensitive information in the wrong hands can lead to further blackmail. 

Victims of this STOP/DJVU variant should as a matter of urgency, remove MIIA ransomware virus from their computer ASAP. You can make use of any reputable antivirus software while your computer is switched to Safe Mode with Networking. This approach will optimize the ability of the antivirus to scan effectively and completely remove the malware. Our team recommends INTEGO Antivirus software for this task. Furthermore, we advise thinking about downloading RESTORO to repair virus damage on Windows OS files.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

How Cybercriminals Distribute Ransomware

The most common way through which ransomware (including MIIA virus) are distributed is when computer users download malicious torrents online. The malware often hibernate in pirated software contents, so when users of such dangerous copies try to activate them, they unwittingly trigger the malware.  Most victims so far have reported downloading malicious torrents prior to a cyber-attack. We strongly advise against the use of fake crack, key generator or any other software content that is not from genuine sources. 

Below are some of the most popular pirated software copies cybercriminals use in distributing ransomware: 

• Cubase;
• Adobe Illustrator;
• Tenorshare 4ukey;
• AutoCad;
• Opera browser;
• Corel Draw;
• VMware Workstation;
• Adobe Photoshop;
• Fifa 20;
• League of Legends;
• Internet Download Manager;
• KMSPico (illegal Windows activation tool).

Computer users who tend to make use of online software torrents should desist from such acts because it’s not worth the risk. Trying to obtain copyrighted software contents illegally can lead to severe malware attack. Another risk associated with such unwholesome practice is the possibility of being slammed with lawsuit due to copyright infringement. Always consider the bigger picture, by obtaining your software needs from the original content producers or their affiliates; you will be helping the industry to grow. Also, remember that any fee you pay to obtain your software contents legitimately is negligible compared to the outrageous ransom fees cybercriminals will demand from you as a victim of ransomware.  Moreover, you won’t be putting your sensitive data at risk of falling into the wrong hands. 

Aside online software torrents, another way cybercriminals distribute ransomware is by sending out malicious email attachments. What they do is to compose believable messages while pretending to be family, friend, colleague or even a popular brand. They will then attach files created on maybe PDF, DOCX or XLS (these platforms are mostly used because they enable JavaScript and other macro functions). So, attaching payload on them and releasing on any computer becomes possible. 

The worrisome part is that some of these cybercriminals have become sophisticated in recent time, thus trying to decipher if an email is genuine or not can be very difficult sometimes. Sometimes, they impersonate popular brands like DHL, eBay or Amazon and give the accompanying file enticing names like Tracking Details, Invoice or Order Summary etc.  They may even decide to hide the sender’s address by using email spoofing techniques to obfuscate it. In such situation, it is best for one to apply common sense and ask some questions like do I have any business with this brand? Why is the sender’s address vague? And so on. 

It has been noted that victims of STOP/DJVU ransomware tend to throw caution to the wind in their desperation to have their files decrypted. In so doing, they often end up complicating issues. You should avoid trying to reach out to dubious websites claiming to offer decryption solution because such doesn’t exist at the moment.  On the contrary, using fake STOP/DJVU decryptors will put your computer at risk of being infected with other ransomware variants like ZORAB, thereby doubly encrypting your files. However, only DiskTuna and Emsisoft currently offer decryption/repair tools with high chances of recovery. 

Further details you need to know about malware

Some people often wonder about the extent of damage that was done on their computer system following a malware attack. This section will explain in details about the technical aspects concerning the malware. The first thing the malware does is to establish build.exe or build2.exe as well as winupdate.exe (this is what triggers the fake display of Windows update screen). The main executable of the ransomware is named with 4 random characters. For example, one of analysed samples uses 5AD4.exe name. The malware then connects to https[:]//api.2ip.ua/geo.json and sends the response to geo.json file. It then begins to gather every piece of information concerning your computer such as its geolocation, time zone, latitude and longitude, zip code and other details and forwards them to their central server. The image provided below is how geo.json file looks like.

The ransomware also collects information about the compromised system into information.txt file and also takes a screenshot of victim’s desktop and also transmits them to C&C server.

Using the geolocation of the computer, it will profile the country code against their list of encryption-exempted countries (the countries are Russia, Syria, Ukraine, Armenia, Tajikistan, Belarus, Kazachstan, Kyrgyzstan, and Uzbekistan). Once it shows positive with any of the listed countries, it will immediately stop any further attempts at encrypting the files. However, if it doesn’t tally with any of them, the ransomware will now access its server and extract online encryption key which it will merge with the victim’s ID before saving them in bowsakkdestx.txt file and to PersonalID.txt file.

The image below captures how these files look like.

If for any reason the malware couldn’t extract online encryption ID, it will opt for the use of an offline one. The only remarkable difference between online ID and offline ID is that while the former is unique to each victim, the latter is uniform for all. You can easily detect if an offline ID was used if it has t1 characters at the end of the personal ID. If offline ID was used, then the victim’s chance to possibly decrypt .miia files becomes brighter. 

More information about this is provided below.

The malware will at this point begin full data encryption by scanning every folder and encrypting them with Salsa20 before locking the encryption key with RSA-2048 key. While the process is still ongoing, the virus will mark each file with additional extension. 

Here is a screenshot of _readme.txt ransom note the ransomware leaves in each folder.

Afterwards, the virus will delete all Volume Shadow Copies by prompting a command task as shown below:

^{vssadmin.exe Delete Shadows /All /Quiet}

In completing the process, the virus will add a list of domains to the Windows HOSTS file, before sticking them to localhost IP. This action will effectively prevent the victim from having access to any of the blacklisted websites. Whenever they try to access them, DNS_PROBE_FINISHED_NXDOMAIN error message will appear on their screen. The cybercriminals go to this length just to ensure the victim does not get any help online.   

At this point, the virus may drop additional Trojans such as AZORULT or VIDAR on the already compromised computer system. 

Remove MIIA Ransomware Virus and Recover Your Files

For victims of the described ransomware, the first step that should be taken is to report the cybercrime to the appropriate local authorities mandated to handle such issues, and of course to remove MIIA ransomware virus as soon as they can. The guide below teaches how to boot a computer using Safe Mode and Networking method. 

If you have successfully completed MIIA virus removal, please take note of the steps as recommended by our industry experts: 

• It is necessary to inform any relevant local law enforcement agency about the cyberattack
• Now is the time to make use of your data backup. However, you must be careful and ensure that the malware is completely removed before attaching any external storage device to your computer.
• You may consider learning how to repair/decrypt files that were encrypted by STOP/DJVU variants.
• No matter how coded your passwords may be, you have got to replace them. These include passwords used on your browser, Telegram, and Steam among others.

With all said and done, always remember to be proactive at all times to avoid falling victim to cybercriminals. Do not visit online torrents libraries and do not open emails or attachments from questionable sources. Above all, install and constantly scan genuine and reliable antivirus software so you can detect/prevent any dangerous malware from infecting your computer. 

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.