How to remove Matroska ransomware virus

Matroska ransomware variants emerge one after another

Matroska virus is a file-encrypting malware that is based on HiddenTear^[1] open source ransomware project. The ransomware encrypts files using AES cipher and demands to pay the ransom in order to get back access to the corrupted data. Victims of this ransomware shouldn't pay the ransom as free data decryption might be possible.

What comes into attention is its entertaining file extension and email domain name. After the virus finished encoding personal files, the files will have .hustonwehaveaproblem@keemail.me or, in other versions, .HOBOT2GOOD file extension appended after the original one. 

Both versions leave a ransom note on the system. The name of it is HOW_TO_RECOVER_ENCRYPTED_FILES.txt. The ransom note is used by the cyber criminals to urge the victim to contact them via the indicated email. According to the note, the crooks are ready to assist victims 24/7.

On August 2017, researchers have noticed two new variant of Matroska ransomware attacking computer users.^[2] The recently discovered Zalupaid and HOBOT2GOOD ransomware are also based on HiddenTear and employ AES cryptography to render victim's records useless. However, the viruses appends new file extensions to files – respectively, .Encrypted[Payfordecrypt@protonmail.com] or .HOBOT2GOOD.

Cyber criminals clearly want to frighten computer users and make them pay the ransom, however, you should not listen to their demands. Instead of paying, remove the virus and try data recovery options we listed below the article.

It doesn’t matter which variant of ransomware attacked your device, you should not follow the instructions provided in the ransom note; perform Matroska removal instead. More information about possible decryption solutions is provided below the article.

The ransom demand

Following data encryption, ransomware installs one of the most important documents – the ransom note. Here cyber criminals provide instructions what victims have to do after the attack. The ransom note starts with the ordinary introduction:

All your files have been encrypted due to a security problem with your PC.
To restore all files, you need a decryption.
If you want to restore them, write us to the e-mail HUSTONWEHAVEAPROBLEM@KEEMAIL.ME.

Once users send an email, they receive the information about the size of the ransom they have to pay. Furthermore, crooks instruct victims to indicate their ID. According to the note, the decryption key will be stored only for 72 hours.

However, taking into account that there are a couple of decrypters released for HiddenTear threat, you should not comply with the demands, but rather remove Matroshka virus. For that purpose, FortectIntego or MalwarebytesMalwarebytes comes in handy.

Variants of Matroska ransom-demanding virus

Zalupaid ransomware virus. This virus emerged in August 2017 as an updated version of Matroska malware. The virus code is still based on HiddenTear open source project and encrypts files using AES encryption algorithm. It locks files with .Encrypted[Payfordecrypt@protonmail.com] file extension. The ransomware can drop one of these ransom notes:

• HOW_TO_RECOVER_ENCRYPTED_FILEA.txt
• zalupka.txt.encrypted[Payfordecrypt@protonmail.com]

Victims are asked to send their personal ID number, which is provided in the ransom note, to payfordecrypt@protonmail.com. Authors of the malware will answer and reveal how much Bitcoins users have to pay for decryption software.

It is said that the faster you contact them, the less you have to pay. The final deadline is 72 hours since the attack. Later the decryption key is supposed to be destroyed. In order to give a guarantee, users can send one unimportant file smaller than 5 Mb for free decryption.

However, victims are not advised to follow these instructions. It’s recommended to remove Zalupaid and try HiddenTear decrypter that is supposed to restore files affected by the this version of Matroska.

HOBOT2GOOD ransomware virus. The newly discovered ransomware was first noticed by researcher Marcelo Rivero on August 22, 2017. The virus continues using HOW_TO_RECOVER_ENCRYPTED_FILES.txt file to place the ransom note, however, in this version, cyber criminals include a new email address – paymifordecrypt@protonmail.ch.

The amount of money that cyber criminals demand for the decryption key is still unknown. However, victims are advised to try existing HiddenTear decryption tools before deciding to pay a ransom. Remember – paying the ransom doesn't guarantee that .HOBOT2GOOD file extension data will be restored. Clearly, cyber criminals' promises are not the ones you can rely on.

Common ransomware attack vectors

Usually, ransomware threats spread via multiple channels:

• spam emails^[3]
• weak Remote Desktop Protocols (RDP)
• exploit kits
• trojans
• corrupted applications and browser extension

More elaborate threats employ several methods to multiple the infection rate. Most popular of them remains spam emails. Though this method purely relies on users’ gullibility, unfortunately, it proves to be effective.

Speaking of Matroska ransomware, it has been detected spreading via RDP. This method does not require a victim’s “contribution.” However, its success rate might be quite slow as well in case a victim does not use Remote Desktop session function.^[4]

In any case, in order to lower the risk of possible infiltration, employ several layers of protection. Install a cyber security tool and stay vigilant when reviewing the spam content.

Remove Matroska virus using professional malware removal tools

Instead of nurturing hopes on hackers’ conscience, Matroska removal is a better option to choose. If a cyber security tool does not correspond to your commands, restart the system in Safe mode, launch an anti-spyware tool and remove Matroshka virus. If you are looking for a tool to clean your PC, you should use FortectIntego, SpyHunterCombo Cleaner or MalwarebytesMalwarebytes.

Below the article, you will several suggestions how to recover the encrypted files without paying the ransom. This malware targets every user, but its distribution rate might be higher in countries, e.g. the Czech Republic^[5], where ransomware awareness is lower.