Maas Ransomware

Maas Ransomware Image

The Maas Ransomware is a new file-encrypting Trojan that is designed to taunt regular users online. File-lockers, like the Maas Ransomware, would compromise your computer, identify the files that will be marked for encryption, lock them, and then ask you for cash in return for a decryption tool that is meant to restore your data. The Maas Ransomware is not a unique file-locker – it is a copy of the STOP Ransomware.

Propagation and Encryption

The Maas Ransomware is meant to target a very wide variety of filetypes to make it more likely for the user to consider paying the ransom fee. As a result of the Maas Ransomware infiltrating your PC, your documents, images, spreadsheets, presentations, archives, audio files, databases, videos, and other filetypes will be locked with a secure encryption algorithm. After the Maas Ransomware is done encrypting your data, you may notice that your files' names have been altered. This is because the Maas Ransomware adds a ‘.maas’ extension to them. This means that if you named a file ‘filtered-water.mp4,’ the Maas Ransomware will rename it to ‘filtered-water.mp4.maas.’ Security experts couldn't pinpoint the specific distribution technique utilized by the Maas Ransomware creators yet. It is likely that they have used bogus software updates, fraudulent emails, fake social media posts, torrent trackers, corrupted advertisements, etc.

The Ransom Note

When the Maas Ransomware executes the encryption process successfully, it will drop a ransom note on the victim’s desktop. The file containing the ransom message of the attackers is called ‘_readme.txt.’ There are several key points in the note:

• Users who contact the attackers within three days have to pay $490 as a ransom fee.
• Users who fail to meet the deadline have to pay double the amount - $980.
• The attackers are willing to unlock one file for free, as long as it does not contain valuable information.
• The contact details of the attackers are ‘helpmanager@firemail.cc’ and ‘helpmanager@iran.ir.’

It is recommended to ignore the demands of cybercriminals. They are unlikely to provide you with the decryption key you need, even if you pay the sum they demand. It is best to remove the Maas Ransomware from your PC sooner rather than later. You can do this with the help of a genuine, up-to-date anti-malware suite.