MARS Ransomware Virus
MARS virus is a new ransomware that has just been identified to be live in an ongoing attack campaign. The ransomware code can be inserted in various payload carriers including application installers and malicious documents. When these malicious files are opened on a PC the associate infection begins. Then MARS virus triggers a long sequence of malicious processes that contaminate the operating system. All changes made by the ransomware make the infected PC extremely vulnerable to further malware attacks. As part of infection with MARS ransomware virus is the encryption of valuable personal data.
The nasty threat scans predefined system drives for specific commonly used types of files and encodes them all with a sophisticated cipher algorithm. As a result, encoded files appear with the .mars file extension. The access to their information is restricted due to their encrypted code. Hackers try to blackmail victims into paying a ransom fee for file decryption. For the extortion, their nasty program drops the file !!!MARS_DECRYPT.TXT and then presents victims with its content.
If your computer device was infected with this ransomware and you see your files as locked .mars files, read on through to find out how you could remove the ransomware, secure the system and potentially restore your files back to normal.
Threat Summary
| Name | MARS |
| Type | Ransomware, Cryptovirus |
| Ransom Note | !!!MARS_DECRYPT.TXT |
| Short Description | The ransomware encrypts files on your computer machine and demands a ransom to be paid to allegedly restore them. |
| Symptoms | The ransomware will blackmail the victims to pay them a decryption fee. Sensitive user data may be encrypted by the ransomware code. |
| Distribution Method | Spam Emails, Email Attachments |
| Detection Tool |
See If Your System Has Been Affected by malware
Download
Malware Removal Tool
|
User Experience | Join Our Forum to Discuss MARS. |
| Data Recovery Tool | Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive. |
MARS File Virus – What Does It Do?
Another name of MARS ransomware is the MARS file virus. It comes from the extension this malware adds to files it encodes. It is not the first time when ransomware with this name appears on the malware scene. Back in April 2017, we at SensorsTechForum reported a strain of the Major ransomware with the same name.
For the nasty infection with this MARS ransomware to begin its payload file should land on the computer operating system. The most popular delivery tactics are probably going to be used by hackers.
The main technique remains the launch of phishing email messages. These messages are designed to imitate well-known services and companies and their representatives. Through them, various malware contents and attachments may be pushed to target PCs. A similar technique – malware sites may complement the propagation of MARS ransomware. Malicious payload files may be uploaded on various sites that serve as download portals.
Once the infection begins, the ransomware will probably start a data harvesting module which will retrieve sensitive information both about the infected machine and the victims. The gathered information can help for the generation of a unique infection ID used for the extortion step.
The MARS ransomware can also use the acquired information in order to scan the system for the presence of any security software in order to successfully bypass them. As soon as an intrusion is made various system settings will be altered. Usually, malicious software like MARS ransomware affects specific Windows Registry keys as well as restore points and backups.
Then the encryption stage takes place. By using a strong cipher target user data gets encoded by the ransomware. Commonly used types of files used by the majority of people are likely to be in the encryption list of the MARS file virus. All of the following files may be encoded: backups, databases, images, videos, music and etc. When this process is complete the .mars extension will be appended to the names of corrupted files. Then a ransom note that is made in a file called !!!MARS_DECRYPT.TXT.
Here is a copy of its text message:
All your files have been encrypted with MARS Virus.
Your unique id: –Our virus encrypted 231 of your office files (xls, xlsx, doc, docx, ppt, pptx, odt, ods, pdf, dwg, psd, dbf, fpt, php, cdr, mdb, accdb).
You can buy decryption for 500$ in Bitcoins.
But before you pay, you can make sure that we can really decrypt any of your files.
The encryption key and ID are unique to your computer, so you are guaranteed to be able to return your files.To do this:
1) Send your unique id – and max 3 files for test decryption to mars_dec@outlook.com or anton_ivan_8989@mail.ru
2) After decryption, we will send you the decrypted files and a unique bitcoin wallet for payment.
3) Be careful! Fakes are possible in Telegram, never pay until you receive test files after decryption!
4) After payment ransom for Bitcoin, we will send you a decryption program and instructions. If we can decrypt your files, we have no reason to deceive you after payment.or do this(If you have not received a reply by email):
1) Download and install Telegram Messanger: hxxps://desktop.telegram.org/ (for Windows, Linux, macOS)
2) Find user mars_dec
3) Send your unique id – and max 3 files for test decryption.
4) After decryption, we will send you the decrypted files and a unique bitcoin wallet for payment.
5) Be careful! Fakes are possible in Telegram, never pay until you receive test files after decryption!
6) After payment ransom for Bitcoin, we will send you a decryption program and instructions. If we can decrypt your files, we have no reason to deceive you after payment.FAQ:
Can I get a discount?
No. The ransom amount is calculated based on the number of encrypted office files and discounts are not provided. All such messages will be automatically ignored.
What is Bitcoin?
read bitcoin.org
Where to buy bitcoins?
hxxps://bitcoin.org/en/buy
hxxps://buy.moonpay.io
or use google.com
Where is the guarantee that I will receive my files back?
The very fact that we can decrypt your random files is a guarantee. It makes no sense for us to deceive you.
How quickly will I receive the key and decryption program after payment?
As a rule, within a few hours, but very rarely there may be a delay of 1-2 days.
How does the decryption program work?
It’s simple. You need to copy the key and select a folder to decrypt. The program will automatically decrypt all encrypted files in this folder and its subfolders.
I will complain about your Telegram account and mailbox’s..
God help you. You won’t find us anyway. But many people will be deprived of any opportunity to recover their files.
We know that you need to restore encrypted .mars files but we recommend that you refrain from transferring money to cybercriminals. Otherwise, you risk losing both your valuable files and money.
For the sake of your security, it is advisable to clean your infected computer from present malicious files and consider the help of alternative data recovery methods.
Remove MARS Files Virus
The so-called MARS file virus is a threat with highly complex code that causes damage to both essential system settings and valuable data. Hence, the only way to use your infected computer in a secure manner again is to remove all malicious files and objects created by the ransomware. For the purpose, you can follow our step-by-step removal guide.
In the event that you want to attempt to restore .mars files with the help of alternative data recovery methods, do check step five – Try to Restore files encrypted by ransomware. We remind you to back up all encrypted files to an external drive before the recovery process.
Gergana Ivanova
Highly motivated writer with 5+ years of experience writing for ransomware, malware, adware, PUPs, and other cybersecurity-related issues. As a writer, I strive to create content that is based on thorough technical research. I find joy in the process of creating articles that are easy to understand, informative, and useful. Follow me on Twitter (@IRGergana) for the latest in the field of computer, mobile, and online security.
Follow Me:
- Guide 1: How to Remove MARS from Windows.
- Guide 2: Get rid of MARS from Mac OS X.
- Guide 3: Remove MARS from Google Chrome.
- Guide 4: Erase MARS from Mozilla Firefox.
- Guide 5: Uninstall MARS from Microsoft Edge.
- Guide 6: Remove MARS from Safari.
- Guide 7: Eliminate MARS from Internet Explorer.
Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer
How to Remove MARS from Windows.
Step 1: Boot Your PC In Safe Mode to isolate and remove MARS
Step 2: Uninstall MARS and related software from Windows
Here is a method in few easy steps that should be able to uninstall most programs. No matter if you are using Windows 10, 8, 7, Vista or XP, those steps will get the job done. Dragging the program or its folder to the recycle bin can be a very bad decision. If you do that, bits and pieces of the program are left behind, and that can lead to unstable work of your PC, errors with the file type associations and other unpleasant activities. The proper way to get a program off your computer is to Uninstall it. To do that:
Follow the instructions above and you will successfully uninstall most programs.
Step 3: Clean any registries, created by MARS on your computer.
The usually targeted registries of Windows machines are the following:
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
You can access them by opening the Windows registry editor and deleting any values, created by MARS there. This can happen by following the steps underneath:
Tip: To find a virus-created value, you can right-click on it and click "Modify" to see which file it is set to run. If this is the virus file location, remove the value.
Before starting "Step 4", please boot back into Normal mode, in case you are currently in Safe Mode.
This will enable you to install and use SpyHunter 5 successfully.
Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer
Get rid of MARS from Mac OS X.
Step 1: Uninstall MARS and remove related files and objects
1. Hit the ⇧+⌘+U keys to open Utilities. Another way is to click on “Go” and then click “Utilities”, like the image below shows:
- Go to Finder.
- In the search bar type the name of the app that you want to remove.
- Above the search bar change the two drop down menus to “System Files” and “Are Included” so that you can see all of the files associated with the application you want to remove. Bear in mind that some of the files may not be related to the app so be very careful which files you delete.
- If all of the files are related, hold the ⌘+A buttons to select them and then drive them to “Trash”.
In case you cannot remove MARS via Step 1 above:
In case you cannot find the virus files and objects in your Applications or other places we have shown above, you can manually look for them in the Libraries of your Mac. But before doing this, please read the disclaimer below:
You can repeat the same procedure with the following other Library directories:
→ ~/Library/LaunchAgents
/Library/LaunchDaemons
Tip: ~ is there on purpose, because it leads to more LaunchAgents.
Step 2: Scan for and remove MARS files from your Mac
When you are facing problems on your Mac as a result of unwanted scripts and programs such as MARS, the recommended way of eliminating the threat is by using an anti-malware program. SpyHunter for Mac offers advanced security features along with other modules that will improve your Mac’s security and protect it in the future.
Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer
Remove MARS from Google Chrome.
Step 1: Start Google Chrome and open the drop menu
Step 2: Move the cursor over "Tools" and then from the extended menu choose "Extensions"
Step 3: From the opened "Extensions" menu locate the unwanted extension and click on its "Remove" button.
Step 4: After the extension is removed, restart Google Chrome by closing it from the red "X" button at the top right corner and start it again.
Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer
Erase MARS from Mozilla Firefox.
Step 1: Start Mozilla Firefox. Open the menu window
Step 2: Select the "Add-ons" icon from the menu.
Step 3: Select the unwanted extension and click "Remove"
Step 4: After the extension is removed, restart Mozilla Firefox by closing it from the red "X" button at the top right corner and start it again.
Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer
Uninstall MARS from Microsoft Edge.
Step 1: Start Edge browser.
Step 2: Open the drop menu by clicking on the icon at the top right corner.
Step 3: From the drop menu select "Extensions".
Step 4: Choose the suspected malicious extension you want to remove and then click on the gear icon.
Step 5: Remove the malicious extension by scrolling down and then clicking on Uninstall.
Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer
Remove MARS from Safari.
Step 1: Start the Safari app.
Step 2: After hovering your mouse cursor to the top of the screen, click on the Safari text to open its drop down menu.
Step 3: From the menu, click on "Preferences".
Step 4: After that, select the 'Extensions' Tab.
Step 5: Click once on the extension you want to remove.
Step 6: Click 'Uninstall'.
A pop-up window will appear asking for confirmation to uninstall the extension. Select 'Uninstall' again, and the MARS will be removed.
Windows Mac OS X Google Chrome Mozilla Firefox Microsoft Edge Safari Internet Explorer
Eliminate MARS from Internet Explorer.
Step 1: Start Internet Explorer.
Step 2: Click on the gear icon labeled 'Tools' to open the drop menu and select 'Manage Add-ons'
Step 3: In the 'Manage Add-ons' window.
Step 4: Select the extension you want to remove and then click 'Disable'. A pop-up window will appear to inform you that you are about to disable the selected extension, and some more add-ons might be disabled as well. Leave all the boxes checked, and click 'Disable'.
Step 5: After the unwanted extension has been removed, restart Internet Explorer by closing it from the red 'X' button located at the top right corner and start it again.
