Dharma ransomware virus has just been detected to append [Mkgoro@india.com].wallet and [Mkgoro@india.com].xtbl to encrypted files on victims’ computers.
Apparently, HTA ransom notes have been at rage lately as the well-known Dharma ransomware is now using them, according to malware researcher @PolarToffee on Twitter.
Dharma Ransomware Virus and Its Extensions – Overview
Dharma virus has gained power and fame in the past months due to being the new variant of the notorious CrySiS ransomware. Dharma uses the AES (Advanced Encryption Algorithm) to encrypt the victims’ files after which it asks the victim to pay a ransom in bitcoins in exchange for a decryption key.
Dharma has been reported to append different extensions to encrypted files. Those known by researchers are: .dharma, .wallet, [firstname.lastname@example.org], .zzzzz, and now the new [Mkgoro@india.com].wallet and [Mkgoro@india.com].xtbl.
With these new file extensions come a new ransom note and a new email to which victims are expected to write to in order to make arrangements with the cyber crooks. The new email is by no surprise Mkgoro@india.com. The ransom note looks like this:
…and it reads as it follows:
All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail email@example.com.
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment, we will send you the decryption tool that will decrypt all your files.
Free decryption as guarantee
Before paying you can send to us up to 3 files for free decryption. Please note that files must not contain valuable information and their total size must be less than 10Mb.
How to obtain BItcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click “Buy bitcoins”, and select the seller by payment method and price.
How to Remove [Mkgoro@india.com] File Extension Virus and Restore My Data
In case your files have been encrypted and have received the [Mkgoro@india.com] file extension, you have become a victim of Dharma ransomware. In this case, however, we urge you not to follow the instructions from the ransom note. You cannot trust cyber crooks who claim they will decrypt your data as soon as you make a payment. What’s more, paying the ransom to the cyber criminals only fosters cyber crime. Instead, follow the instructions below on how to get rid of the infection and see possible ways to restore some of your data via a powerful anti-malware tool.
Manually delete [Mkgoro@india.com] from your computer
Note! Substantial notification about the [Mkgoro@india.com] threat: Manual removal of [Mkgoro@india.com] requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.