Mailto (Koko - Netwalker) - Kazkavkovkiz (.mailto, Readme.txt) Support Topic

SHA1: de13c776ab7dc088c2e9dc91e486f48bdcdaa594[/size]
 
Random 4 character extension per machine. Note follows:
 
Hi!
Your files are encrypted.
All encrypted files for this computer has extension: .1401
 
--
 
If for some reason you read this text before the encryption ended,
this can be understood by the fact that the computer slows down, 
and your heart rate has increased due to the ability to turn it off,
then we recommend that you move away from the computer and accept that you have been compromised,
rebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,
it could be files on the network belonging to other users, sure you want to take that responsibility?
 
--
 
Our encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.
The only way to get your files back is to cooperate with us and get the decrypter program.
Do not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.
 
We advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.
For us this is just business and to prove to you our seriousness, we will decrypt you some files for free, 
but we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.
 
Сontact us:
1.kazkavkovkiz@cock.li
2.Hariliuios@tutanota.com
 
Don't forget to include your code in the email:
{code_1401:smjErehmmb8LN/ANr+7IThQKwUq3HbWCnh6hI5U0QmCXxlLi+E
vx5Fcfp3p4q8GUCIEw9pQzIHugCWZqozxmIES39ohGqXRDXKkv
Ri/rJHtNC3J8BRvrrbqFYkJrDrwLLBBK7127c3qEyJf8EyOXhn
WNQ7dH6oAO6qAejWIE0XH73AqHeQ1hiAeiB3U7vviDKLzYTG9z
V/DoxL9iM4CUbz8ZtVpqeIO7mw0OWcsx5oHkXVqGXg1SziRPKT
d58WyzVj5niEeKrAlRhd9eJb00pEtFcw==}

Edited by Amigo-A, 13 October 2019 - 03:23 AM.

There are several different ransomware infections which append a random 3, 4, 5, 6, 7, 8, etc character extension to the end of all affected filenames to include Magniber, Sodinokibi (REvil), STOP (DJVU), MrDec (Mr.Dec), Snatch, GermanWiper, CTB-Locker, Crypt0L0cker, GandCrab V5+, CryptON (Cry9, Cry36, Cry128, Nemesis), Skull, SynAck, Maktub Locker, Alma Locker, Princess Locker, Princess Evolution, Locked-In, Mischa, Goldeneye, Al-Namrood 2.0, Cerber v4x/v5x and some Xorist variants.

The best way to identify the different ransomwares that use "random character extensions" is the ransom note (including it's actual name and contents), samples of the encrypted files, possible filemarkers, the malware file itself responsible for the infection and information related to any email addresses or hyperlinks provided by the cyber-criminals to request payment. Without any of that information or a file marker/unique hex pattern identifier, it is difficult to determine what you are dealing with.

Without the above information or if this is something new, our crypto malware experts most likely will need a sample of the malware file itself to analyze before anyone can ascertain if the encrypted files can even be decrypted. Samples of any suspicious executable's (installer, malicious files, attachments, .etc) that you suspect were involved in causing the infection can be submitted (uploaded) here with a link to this topic...it's best to zip (compress) all files before sharing. There is a "Link to topic where this file was requested" box under the Browse button. Alternatively, you can upload a sample to VirusTotal and provide a link to the results.

We have seen this exact one as well.  I will keep following this.  Any similar ones to look at?  What is the best reverse engineering tools that you use?  I would love to help on this issue if possible.  

-Sincerely

DesertAdmin 

We need to get files from the victim to help him and / or start a separate investigation.

I sent a file that was encrypted already I can get more if needed.  

-DesertAdmin

As I noted above...we need a sample of the malware file itself to analyze. Samples of any suspicious executable's (installer, malicious files, attachments, .etc) that you suspect were involved in causing the infection can be submitted (uploaded) here with a link to this topic...it's best to zip (compress) all files before sharing. There is a "Link to topic where this file was requested" box under the Browse button. Alternatively, you can upload a sample to VirusTotal and provide a link to the results.

I submitted more files please check. 

-Desertadmin

https://www.virustotal.com/gui/file/e0b1401ffa169660e1e873d474cb3fca1fb70a42d36e5d8928d5e8e019ad3e96/detection

All clean

desertadmin

Thanks for the info and link. Encrypted files are usually safe, except in some cases.

Edited by Amigo-A, 16 October 2019 - 06:58 AM.

I read a news about ransomware before 1.5 years ago. Lots of country computers were hacked at a time. It there need to pay hacker in order to get back your computer like before. 

You can submit (upload) samples of encrypted files, ransom notes and any contact email addresses or hyperlinks provided by the malware developer to ID Ransomware (IDR) or Emsisoft Identify your ransomware for assistance with identification and confirmation of the infection. This is a service that helps identify what ransomware may have encrypted your files, whether it is decryptable and then attempts to direct you to an appropriate support topic where you can seek further assistance. ID Ransomware can identify ransomwares which adds a prefix instead of an extension and more accurately ransomwares by filemarkers if applicable. Uploading both encrypted files and ransom notes together along with any contact email addresses or hyperlinks provided by the criminals gives a more positive match with identification and helps to avoid false detections.

Amigo-A and I both agree this looks to be a new variant off of Mailto. I have merged the detection signatures on ID Ransomware.

https://twitter.com/GrujaRS/status/1169354031791300608

Have not had time to analyze if it is secure or not yet.

Just got infected by this!

Any news about this or decryption status.