'mkgoro@india.com' Ransomware
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Ranking: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Ranking: | 13,267 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 124 |
| First Seen: | December 30, 2016 |
| Last Seen: | September 10, 2023 |
| OS(es) Affected: | Windows |
The 'mkgoro@india.com' Ransomware is another variant of the Dharma Ransomware that surfaced not too long after the 'amagnus@india.com' Ransomware and the 'supermagnet@india.com' Ransomware that belongs to the same family of crypto-threats. The team behind Dharma seems busy releasing their Trojan under new names and tend to switch between email accounts. PC security researchers alert that the new version of Dharma is delivered the same way as its older forms—spam emails. Computer users may encounter emails that appear legitimate, include logos from social media, payment portals, and banks as well as an invitation to download and open a file with a random name. Most infiltration techniques used to install the 'mkgoro@india.com' Ransomware involve a macro-enabled text document, but we have seen JavaScript-enabled archive files too.
The 'mkgoro@India.com' Ransomware should not be Underestimated, and You Need to Backup Your Data
The 'mkgoro@india.com' Ransomware is known to target data containers stored in the default user library. Newer variants of Dharma can lock files located on removable drives like thumb drives and media players. In-depth analysis of 'mkgoro@india.com' Ransomware shows that the encryption Trojan is using a combination of the AES and RSA ciphers to secure the encryption routine. Put into simple terms, the 'mkgoro@india.com' Ransomware uses a unique key to lock your data and then uses another unique key to encipher the first one. Both keys are stored on the PC temporarily, and the enciphered key is the one sent to the 'Command and Control' (C&C) server of the operators. The C&C server is the panel used by threat actors to manage infected computers remotely.
Enciphered Objects Feature the '.mkgoro@India.com.dharma' Extension
For example, 'Trochilidae hummingbird.jpeg' is transcoded to 'Trochilidae hummingbird.jpeg.mkgoro@India.com.dharma.' The encryption process may take a while considering that many users may keep their private files in the library provided on Windows 7 and later versions. Advanced users that incorporate tools like ProcessExplorer may notice the activity of 'mkgoro@india.com' Ransomware on their PCs since the primary executable of the Trojan may hijack a lot of system resources. If you spot the 'mkgoro@india.com' Ransomware and terminate its process, you may be able to save most of your files. Otherwise, you will be presented with the ransom note in the form of an HTA app named 'info.hta.' Security researchers report that the ransom note for 'info.hta' may be found in the startup folder. The note reads:
'All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail mkgoro@india.com You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment, we will send you the decryption tool that will decrypt all your files.
Free decryption as guarantee
Before paying you can send to us up to 3 files for free decryption. Please note that files must NOT contain valuable information, and their total size must be less than 10Mb.
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy-bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/'
You are Supposed to Write to Mkgoro@India.com and Obtain Payment Instructions
Experts do not encourage paying the ransom and making contact with Mkgoro@India.com because you may lose your money and data. The team of cyber-extortionists that manage the 'mkgoro@india.com' Ransomware is not trustworthy, and you should explore safer alternatives to restore your files. The best way to deal with the 'mkgoro@india.com' Ransomware is to eradicate the Trojan using a reliable anti-malware scanner. You may want to put the encrypted files into a single archive file and hope that keys will be released for free in the future. If you have backup images, use them to recover your data and make sure they were not saved to the computer at the time when the 'mkgoro@india.com' Ransomware was busy encrypting your data.
Submit Comment
Please DO NOT use this comment system for support or billing questions. For SpyHunter technical support requests, please contact our technical support team directly by opening a customer support ticket via your SpyHunter. For billing issues, please refer to our "Billing Questions or Problems?" page. For general inquiries (complaints, legal, press, marketing, copyright), visit our "Inquiries and Feedback" page.