CookiesHelper Ransomware Will Lock Your Files

CookiesHelper, a type of ransomware identified during the examination of new malware samples, is designed to encrypt files. Upon encryption, it appends the ".cookieshelper" extension to filenames, transforming, for instance, "1.jpg" into "1.jpg.cookieshelper" and "2.png" into "2.png.cookieshelper." Additionally, CookiesHelper issues a ransom note named "FILE RECOVERY.txt," containing instructions for contacting cybercriminals and other pertinent details.

This ransomware variant is affiliated with the Mallox ransomware family. The ransom note stipulates a Bitcoin payment for the decryption of locked files, providing guidance on the payment process and cautioning against using third-party decryption software due to the risk of permanent data loss. The note also offers a limited opportunity for a single free decryption, subject to specific criteria.

Victims are explicitly advised against renaming encrypted files and warned that attempting to delete a file with a designated extension could result in irreversible damage. Furthermore, the note emphasizes the potential risks associated with seeking decryption services from third parties, including elevated costs and susceptibility to scams.

To initiate communication for file restoration, the victim is instructed to contact a designated email address (cookieshelper@tutanota.com), with a unique ID required in the message title.

CookiesHelper Ransom Note Offers Decryption of a Single File

The complete text of the CookiesHelper ransom note reads as follows:

YOUR FILES ARE ENCRYPTED !!!

TO DECRYPT, FOLLOW THE INSTRUCTIONS:

You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files.
Free decryption as guarantee
Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)

Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
If you delete a file with an extension (_TMP) This will cause this file to permanently damage!!!!!

Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

If you want to restore them, write us to the e-mail
cookieshelper@tutanota.com
Write this ID in the title of your message
ID:-

How Can Ransomware Like CookiesHelper Infect Your Computer?

Ransomware, such as CookiesHelper, can infect your computer through various means. Here are some common methods:

Phishing Emails: Cybercriminals often use phishing emails to distribute ransomware. They send emails that appear legitimate, with attachments or links that, when opened, execute the ransomware code. These emails may masquerade as invoices, job applications, or other seemingly harmless content.

Malicious Websites: Visiting compromised or malicious websites can expose your computer to ransomware. Some websites may contain exploit kits that automatically download and install malware on your system if it has vulnerabilities.

Malvertising: Malicious advertising, or malvertising, involves placing malicious code in online advertisements. Clicking on these ads, even on legitimate websites, can lead to the download and execution of ransomware.

Exploiting Software Vulnerabilities: Ransomware creators often take advantage of vulnerabilities in operating systems or software. If your system is not up-to-date with security patches, it may be susceptible to exploitation.

Drive-By Downloads: Drive-by downloads occur when malware is automatically downloaded and installed on your computer without your knowledge or consent. This can happen when you visit a compromised website that exploits vulnerabilities in your browser or other software.

Social Engineering: Cybercriminals may use social engineering techniques to trick users into downloading and running malicious files. This can involve enticing users with fake software updates, free downloads, or other seemingly legitimate content.