Researchers Release MortalKombat Ransomware Decryptor

Victims of the MortalKombat ransomware variant have been handed a lifeline, following Bitdefender unveiled a new decryption essential on Tuesday.

The security agency said it had been checking MortalKombat due to the fact its appearance in January this 12 months.

“Based on the Xorist ransomware, MortalKombat spreads via phishing e-mail and targets exposed RDP scenarios,” it defined. “The malware gets planted by the BAT Loader that also delivers the Laplas Clipper malware.”

In reality, it is the variant’s fundamental Xorist codebase which is likely to have enabled the security researchers to provide a decryption vital in file time. Xorist is a commodity ransomware household for which a decryptor has been readily available for several a long time.

Victims of MortalKombat had their info encrypted, and information had been created with an unusually long extension: “Remember_you_acquired_only_24_several hours_to_make_the_payment_if_you_dont_pay out_prize_will_triple_Mortal_Kombat_Ransomware.”

They also discovered the desktop wallpaper modified to a Mortal Kombat theme and a ransom note titled: “Hhow to decrypt documents.txt.”

Bitdefender explained its decryptor could also be executed silently by using a command line – particularly helpful for companies seeking to automate its deployment inside of a significant network.

As documented by Infosecurity, the initial MortalKombat danger actor was also observed dropping the Laplas Clipper clipboard stealer malware, to goal cryptocurrency end users.

“Laplas Clipper targets users by employing common expressions to observe the sufferer machine’s clipboard for their cryptocurrency wallet address,” explained Cisco Talos in its original report on the marketing campaign.

“Once the malware finds the victim’s wallet deal with, it sends it to the attacker-controlled Clipper bot, which will create a lookalike wallet tackle and overwrite it to the victim’s machine’s clipboard. If victims subsequently endeavor to use the lookalike wallet tackle when carrying out transactions, the consequence will be a fraudulent cryptocurrency transaction.”

Bitdefender’s most current decryption important announcement arrives incredibly hot on the heels of a similar tool made to support victims of the MegaCortex ransomware variant. That key was published in January this year, even though a previous 1, for the LockerGaga ransomware relatives, was unveiled in September 2022.

Editorial credit score icon image: Ralf Liebhold / Shutterstock.com

Some parts of this article are sourced from:
www.infosecurity-magazine.com