How to remove Checkmate ransomware

Checkmate ransomware targets businesses to be able to extort even more moneyCheckmatem

Checkmate ransomware is a file-locking virus that uses complicated encryption algorithms to lock users' files, such as photos, videos, and documents. The locked files cannot be opened or viewed. Cybercriminals want to extort victims by promising to provide a decryption key if they pay the ransom.

Once the malware infiltrates the machine, it appends files with the .checkmate extension. So if a file was previously named picture.jpg, after encryption is done, it would look like this – picture.jpg.checkmate. The icons also change to white pages so thumbnails become unavailable. Shortly after, a ransom note is generated on the machine.

The ransom note

The full !CHECKMATE_DECRYPTION_README.txt ransom note reads as follows:

You was hacked by CHECKMATE team.
All your data has been encrypted, backups have been deleted.
Your unique ID: –
You can restore the data by paying us money.
We have encrypted – office files.
We determine the amount of the ransom from the number of encrypted office files.
The cost of decryption is 15000 USD.
Payment is made to a unique bitcoin wallet.
Before paying, you will be able to make sure that we can actually decrypt your files.
For this:
1) Download and install Telegram Messenger hxxps://telegram.org/
2) Find us hxxps://t.me/checkmate_team
3) Send a message with your unique ID and 3 files for test decryption. Files should be no more than 15mb each.
4) In response, we will send the decrypted files and a bitcoin wallet for payment. Bitcoin wallet is unique for you, so we can find out what you paid.
5) After the payment is received, we will send you the key and the decryption program.

Threat actors say that they have encrypted office files, so it might be that this variant specifically targets businesses. The price set for the decryption tool is quite high – $15000. Cybercriminals want it to be paid in cryptocurrencies,^[1] more specifically Bitcoin.

Ransomware developers choose this payment method because it provides anonymity. Once you send a cryptocurrency transaction to another wallet, it is impossible to get it back. Additionally, threat actors cannot be trusted. Many previous ransomware attack victims have come forward and said that they never received the promised decryption keys after paying the ransom.

Distribution methods

There are a lot of ways ransomware could have infected your computer.  One of the most common methods of infection is “cracked” software^[2] installations. Sites that distribute them disguise malicious programs as legitimate or hide malware between the files. It is impossible to know which programs on Torrent websites, or peer-to-peer file-sharing platforms are safe to download.

Another common method used by hackers is malspam. With this method, threat actors add infected attachments to the email and use social engineering techniques to encourage users to open it. The email might include PDFs or Word documents. It might also contain links to malicious websites.^[3]

Often the emails look like they came from a colleague or friend, but if you were not expecting to receive a file via email, you should check with that person through another platform just in case. Hackers can use your friend list against you and make the message even more believable.

Isolate the affected machine

As the creators of this malicious program seem to be targeting businesses, you need to isolate the affected machine so the virus would not infect the entire network. As soon as one of the machines is infected, malware can spread via the network and encrypt files everywhere else, including Network Attached Storage (NAS) devices. If your computer is connected to a network, it is important to isolate it to prevent re-infection after ransomware removal is complete.

The easiest way to disconnect a PC from everything is to plug out the ethernet cable. In the corporate environment, this might be extremely hard to do and time-consuming. The method below will disconnect from all the networks, including local and the internet, isolating each machine involved.

• Type in Control Panel in Windows search and press Enter
• Go to Network and Internet
• Click Network and Sharing Center
• On the left, pick Change adapter settings
• Right-click on your connection (for example, Ethernet), and select Disable
• Confirm with Yes.

If you are using some type of cloud storage, you should disconnect from it immediately. It is also advisable to disconnect all the external devices, such as USB flash sticks, external HDDs, etc. Once the malware elimination process is finished, you can connect your computers to the network and internet, as explained above, but by pressing Enable instead.

Remove the intruder from your machine

If you try to recover your data first, it can result in permanent loss. It can also encrypt your files the second time. It will not stop until you remove the malicious files causing it first. It would be best if you did not attempt to remove the malicious program yourself. Use anti-malware tools like SpyHunterCombo Cleaner or MalwarebytesMalwarebytes to scan your system. This security software should find all the related files and entries and remove them automatically for you. Automatic removal is the best option because there is less risk of leaving some of the traces behind.

If the virus prevents you from using security software, you first need to access Safe Mode. If you do not know how to do it, look for instructions at the bottom of the post.

Recovery using third-party software

Only hackers hold the decryption key, which can unlock your files, so if you did not back them up previously, you possibly lost your files forever. You can try using data recovery software, but third-party programs cannot always decrypt the files. We suggest at least trying this method. Before proceeding, you have to copy the corrupted files and place them in a USB flash drive or another storage. And remember – only do this if you have already removed Checkmate ransomware.

1. Download Data Recovery Pro.
2. Double-click the installer to launch it.
3. Follow on-screen instructions to install the software.
4. As soon as you press Finish, you can use the app.
5. Select Everything or pick individual folders where you want the files to be recovered.
6. Press Next.
7. At the bottom, enable Deep scan and pick which Disks you want to be scanned.
8. Press Scan and wait till it is complete.
9. You can now pick which folders/files to recover – don't forget you also have the option to search by the file name!
10. Press Recover to retrieve your files.

Fix system errors

Performance, stability, and usability issues, to the point where a complete Windows reinstall is required, are expected after malware infection. These types of infections can alter the Windows registry database, damage vital bootup, and other sections, delete or corrupt DLL files, etc. Once a system file is damaged by malware, antivirus software is not able to repair it. 

This is why FortectIntego was developed. It can fix a lot of the damage caused by an infection like this. Blue Screen errors, freezes, registry errors, damaged DLLs, etc., can make your computer completely unusable. By using this maintenance tool, you could avoid Windows reinstallation.

• Download the application by clicking on the link above
• Click on the ReimageRepair.exe
  
• If User Account Control (UAC) shows up, select Yes
• Press Install and wait till the program finishes the installation process
• The analysis of your machine will begin immediately
• Once complete, check the results – they will be listed in the Summary
• You can now click on each of the issues and fix them manually
• If you see many problems that you find difficult to fix, we recommend you purchase the license and fix them automatically.