Infected with MAFIA Ransomware? Need to decrypt your files?
What is MAFIA Ransomware
MAFIA is another cryptovirus, developed by Jin Woo (진우), extorting money for decryption. Like many analogs, MAFIA encrypts data on the user’s computer using the AES-256 encryption algorithm and changes the file extension to .MAFIA or .mafia. After encryption, the virus creates a special Information.html file containing information about redemption.
text in this note:
고유넘버 : 853e11f617b2b91ae549e7f50718262
고유넘버 : 6fe795f490c7732ac5e6186ca493718b
here’s English translation:
Unique number : 853e11f617b2b91ae549e7f50718262
Unique number : 6fe795f490c7732ac5e6186ca493718b
The cost of redemption and any details are missing, which means that Ransomware is under development and is not finished. Moreover, the user can even stop the encryption process on his own or shut down the operating system. Be that as it may, for sure the attackers will finish what they started, so be on the alert and watch for the latest updates on this topic.
Update: Use following service to identify the version and type of ransomware you were attacked by: ID Ransomware. If you want to decrypt your files, please follow our instruction below or, if you have any difficulties, please contact us: submit@securitystronghold.com. We really can help to decrypt your files.
How MAFIA infected your PC
Such cryptoviruses penetrate the PC without the user’s consent, leaking through unprotected network connections, as well as attachments in spam mailing, false updates for programs and utilities and so on. The most appropriate way to secure your computer is to prevent the penetration of such cryptoviruses. Use reliable and proven anti-virus software. If MAFIA already penetrated your PC, then use our recommendations listed below.
First of all, don’t panic. Follow these easy steps below.
1. Start your computer in Safe Mode with networking. To do that, restart your computer before your system starts hit F8 several times. This will stop system from loading and will show Advanced boot options screen. Choose Safe mode with networking option from the options list using up and down arrows on your keyboard and hit Enter.
2. Log in to the system infected with the MAFIA virus. Launch your Internet browser and download a reliable anti-malware program and start a full system scan. Once the scan is complete, review scan results and remove all entries detected.
Recommended Solution:
Norton is a powerful removal tool. It can remove all instances of newest viruses, similar to MAFIA – files, folders, registry keys.
*Trial version of Norton provides detection of computer viruses for FREE. To remove malware, you have to purchase the full version of Norton.
You may find more detailed information about antivirus products in our article – Top 5 Antivirus Software for Windows
Restore your files using shadow copies
- Download and run Stellar Data Recovery.
- Select type of files you want to restore and click Next.
- Select the drive and folder where your files are located and date that you want to restore them from and press Scan.
- Once the scanning process is done, click Recover to restore your files.
Step 2: Remove following files and folders of MAFIA:
Related connections or other entries:
C2: http://onion.pet/
wibkilmskir4rlxz.onion.plus
Related files:
Information.html
Information.html.mafia
winlogin.exe
f4b25591ae53504ef5923344a9f03563
da23c8a7be5d83ae3e6b7b3291fdb880
0776e348313c7680db86ed924cff10b8
6487edd9b1e7cf6be4a9b1ac57424548
119228fb8f4333b1c10ff03543c6c0ea
How to decrypt files infected by MAFIA?
You can try to use manual methods to restore and decrypt your files.
Decrypt files manually
Restore the system using System Restore
Although latest versions of MAFIA remove system restore files, this method may help you partially restore your files. Give it a try and use standard System Restore to revive your data.
- Initiate the search for ‘system restore‘
- Click on the result
- Choose the date before the infection appearance
- Follow the on-screen instructions
Roll the files back to the previous version
Previous versions can be copies of files and folders created by Windows Backup (if it is active) or copies of files and folders created by System Restore. You can use this feature to restore files and folders that you accidentally modified or deleted, or that were damaged. This feature is available in Windows 7 and later versions.
- Right-click the file and choose Properties
- Open the Previous Version tab
- Select the latest version and click Copy
- Click Restore
Protect your computer from ransomware
Most modern antiviruses can protect your PC from ransomware and crypto-trojans, but thousands of people still get infected. There are several programs that use different approach t protect from ransomware and lockers. One of the best is HitmanPro.Alert with CryptoGuard. You may already know HitmanPro as famous cloud-based anti-malware scanner. Check out ultimate active protection software from SurfRight.
Written by Rami Douafi