MLF Ransomware is a New Phobos Clone that Encrypts Files

ransomware

Security researchers spotted a new Phobos ransomware variant in the wild. The new clone is called the MLF ransomware.

The MLF ransomware behaves like most recent Phobos clones. It encrypts almost every file on the targeted system, leaving intact files essential to the continued operation of the OS.

Encrypted files receive a multi-string extension that consists of the victim's ID code, the email used by the MLF ransomware operator and the ".MLF" extension. The encryption process will leave a file formerly called "document.doc" as "document.doc.id[victim ID].[DataRecovery1@cock.li].MLF".

The encryption process affects documents, archive files, media and database file types.

The ransomware deposits its ransom note inside two separate files - info.txt and info.hta, with the latter displayed as a pop-up window. The pop-up window contains the following message:

All your files have been encrypted!

All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail DataRecovery1 at cock dot li

Write this ID in the title of your message -

Our online operator is available in the messenger Telegram: @Datarecovery1

You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.

Free decryption as guarantee

Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)

How to obtain Bitcoins

The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.

hxxps://localbitcoins.com/buy_bitcoins

Also you can find other places to buy Bitcoins and beginners guide here:

hxxp://www.coindesk.com/information/how-can-i-buy-bitcoins/

Attention!

Do not rename encrypted files.

Do not try to decrypt your data using third party software, it may cause permanent data loss.

Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

September 12, 2022
Loading...

Cyclonis Backup Details & Terms

The Free Basic Cyclonis Backup plan gives you 2 GB of cloud storage space with full functionality! No credit card required. Need more storage space? Purchase a larger Cyclonis Backup plan today! To learn more about our policies and pricing, see Terms of Service, Privacy Policy, Discount Terms and Purchase Page. If you wish to uninstall the app, please visit the Uninstallation Instructions page.

Cyclonis Password Manager Details & Terms

FREE Trial: 30-Day One-Time Offer! No credit card required for Free Trial. Full functionality for the length of the Free Trial. (Full functionality after Free Trial requires subscription purchase.) To learn more about our policies and pricing, see EULA, Privacy Policy, Discount Terms and Purchase Page. If you wish to uninstall the app, please visit the Uninstallation Instructions page.