MLF Ransomware is a New Phobos Clone that Encrypts Files
Security researchers spotted a new Phobos ransomware variant in the wild. The new clone is called the MLF ransomware.
The MLF ransomware behaves like most recent Phobos clones. It encrypts almost every file on the targeted system, leaving intact files essential to the continued operation of the OS.
Encrypted files receive a multi-string extension that consists of the victim's ID code, the email used by the MLF ransomware operator and the ".MLF" extension. The encryption process will leave a file formerly called "document.doc" as "document.doc.id[victim ID].[DataRecovery1@cock.li].MLF".
The encryption process affects documents, archive files, media and database file types.
The ransomware deposits its ransom note inside two separate files - info.txt and info.hta, with the latter displayed as a pop-up window. The pop-up window contains the following message:
All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail DataRecovery1 at cock dot li
Write this ID in the title of your message -
Our online operator is available in the messenger Telegram: @Datarecovery1
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.
Free decryption as guarantee
Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
hxxps://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
hxxp://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
