Mapo ransomware: what it is and how to remove it

From our report of Nov 2019 · not reviewed since

Mapo ransomware is a file locking virus which stems from Outsider malware family

Mapo ransomware is a type of malware that focuses money extortion by blackmailing users to pay a ransom after locking all personal files on the infected machine.

Just as many other malicious programs of such type, it enters host machines by using various deceptive methods and then encrypts all data by using a sophisticated encryption algorithm (RSA), preventing victims from accessing their pictures, documents, videos, etc. Each of the files modified in such a way is marked by .mapo extension, for example, a picture.jpg is turned into a picture.jpg.mapo.

Additionally, Mapo virus also inserts a MAPO-Readme.txt file into most folders on the machine - it serves as a message from ransomware developers. Hackers claim that victims need to write an email to support.mbox@pm.me or support-mapo@pm.me with the attached ransom note to negotiate the ransom, which is paid in Bitcoin.

Mapo ransomware is a variant of Outsider, which itself stems from GarrantyDecrypt ransomware. This malware strain often targets businesses and organizations, so it encrypts all the files on the connected networks and drives as well. At the time of the writing, there is no Mapo decryptor available, and, while some victims managed to get their data back by paying criminals, some victims never got the decryption software even after paying.

Because Mapo ransomware aims to infect organisations mostly, it is highly likely that is uses one of the following popular malware delivery methods:

Nevertheless, malware authors can also use such methods as spam emails, software cracks, fake updates, web infects, and similar methods for Mapo virus propagation when it comes to regular users. Therefore, it is always important to install comprehensive security software that would prevent ransomware intrusions. Keep in mind that Mapo ransomware removal can also only be performed with anti-malware software.

Once the malicious executable is launched from the Desktop, Mapo ransomware performs a variety of changes to the system, including modification of Windows registry and Master Boot Record, Shadow Volume Copy deletion, etc. Once the system preparations are complete, the virus encrypts all the data on the host machine as well as all the connected networks and contacts a remote server, which allows the communication.

After that, users are presented with the MAPO-Readme.txt ransom note which states the following:

While it is true that the key required to unlock all files is only accessible to the attackers and that the data might get corrupted after users remove Mapo ransomware, it does not mean that you should oblige to the demands. First of all, it is advisable to make a backup of the encrypted data and then get rid of the virus with anti-malware software.

As for .mapo file recovery, you can try using third-party recovery software if no backups are available to you, or if the malware encrypted backups as well. By all means, there is still an option of paying the ransom for the decryptor, but keep in mind that some users did not receive the tool even after paying a ransom of $2,000 - $4,000.

• Weak Remote desktop connections
• Targeted malicious emails
• Software vulnerabilities

From our report of Nov 2019 · not reviewed since

Protect your machine and all the connected networks from ransomware

Ransomware developers often operate large campaigns and release new versions of malware to obtain maximum profits from the illegal business.

That being said, most hackers are sophisticated individuals who chose the wrong path for using their intelligence, as they are stealing money from innocent people. They also often openly laugh about users not being careful, or even indicate security flaws in the ransom note itself.

Regardless of how gruesome the ransomware business is, getting infected with the malware is something that can be avoided, along with as adequate security measures are practiced. The fundamental rule when it comes to cybersecurity is good online practices that are combined with adequate security tools that reinforce the protection even more. Here are some tips from industry experts that will help you avoid most of malware in the future:

• Install reputable anti-malware software and keep it updated;
• Patch Windows along with all the installed applications with the latest security updates;
• Disable RDP when not used;
• Use adequate passwords and avoid default TCP port when using RDP;
• Never allow MS Office documents attached to emails to run macro commands by pressing "Enable Content";
• Use strong passwords for everything and never reuse them;
• Use two-factor authentication where possible;
• Install ad-block to prevent malicious ads from executing the background scripts;
• Uninstall Flash Player and Java;
• Backup all your important files and keep them on a remote server or external device.

From our report of Nov 2019 · not reviewed since

Mapo ransomware removal steps

While it is possible to remove Mapo ransomware manually, the process would require advanced computer and malware operation knowledge.

Therefore, it is best to use reputable anti-malware software like or to do the job. Be aware that malware is constantly evolving, so not all AV engines can recognize new variants straight away - in some cases, you might have to use several anti-malware tools until the malicious payload is terminated.

It is also worth noting that some Mapo ransomware removal might be prevented due to self-protection mechanisms, or the virus might disable anti-malware software altogether. To prevent that from happening, you should access Safe Mode with Networking and perform a full system scan from there.

When it comes to file recovery, it might be possible to recover at least some portion of .mapo encrypted files with the help of third-party recovery tools. The success rate of it declines the more infected machine gets used, and recovery software might not work at all.

As previously mentioned, make sure you make a copy of all the encrypted files before you do anything. If the decryption with recovery software is unsuccessful, you should wait till security experts find a bug in the malware code or till law enforcement catches criminals, consequently making them release all the keys.

[GI=method-1]If Mapo ransomware interferes with virus removal, access Safe Mode with Networking:

[GI=method-2]Use Safe Mode to get rid of the virus:

Data recovery software might recover at least some of the locked files, although it highly depends on how much the machine was used post-infection.

Make use of Windows Previous Versions feature

If you had System Restore enabled, you might be able to retrieve files one-by-one.

ShadowExplorer might sometimes retrieve all your encrypted files

Mapo ransomware always attempts to remove Shadow Volume Copies. If this operation fails, ShadowExplorer might be able to recover all your files.

No decryptor is currently available