Meka Ransomware

Ransomware threats are growing in popularity, and there is a variety of ways to build one without having much experience in the sphere. Some criminals use special ransomware-builder toolkits to create file-locking Trojans, others borrow code from popular threats of this type and adjust it according to their needs. The authors of the Meka Ransomware have taken the second approach. The Meka Ransomware is a recently spotted data-encrypting Trojan, which belongs to the STOP Ransomware family.

Propagation and Encryption

Ransomware authors tend to propagate their creations via spam email campaigns. This is one of the most popular propagation methods regarding ransomware threats. It is done by crafting a clever fraudulent message, which attempts to induce the user into opening the file that is attached to the email. The attached file is macro-laced and will infect the target's system once they launch it. File-locking Trojans like the Meka Ransomware also are often distributed via torrent trackers and fake software updates too. The Meka Ransomware likely targets a very wide variety of file types as the end goal of the threat is to cause as much damage as possible. The Meka Ransomware appears to go after files, which are likely to be found on any regular user’s computer - .mp3, .png, .jpeg, .jpg, .gif, .ppt, .doc, .docx, .pdf, .mov, .rar, .xls, etc. The Meka Ransomware will then execute its encryption process and lock all the targeted data. Upon encrypting the files of interest, the Meka Ransomware will apply a '.meka' extension to the filenames. For example, a file that was named 'high-flight.mp3' originally, will be renamed to 'high-flight.mp3.meka' after the Meka Ransomware applies its encryption algorithm.

The Ransom Note

The Meka Ransomware will drop a ransom note on the victim's desktop called '_readme.txt,' which is a trademark of ransomware threats that are copies of the STOP Ransomware. In the note, the attackers claim that victims who contact them within 72 hours of the attack taking place will only have to pay half the original ransom fee, meaning that the price will be dropped to $490. However, users who do not manage to make it before the deadline set by the attackers will have to pay the full price, which is $980. As a proof that they have a working decryption key, the authors of the Meka Ransomware claim that they are willing to unlock one file free of charge, as long as it does not contain any valuable information. The attackers provide two email addresses where the user can get in touch with them – ‘salesrestoresoftware@firemail.cc' and ‘salesrestoresoftware@gmail.com.'

It is advisable to ignore the demands of cybercriminals as they deliver on their promises rarely. This is why it is much safer to download and install a reputable anti-malware tool, which will aid you in removing the Meka Ransomware from your computer.