Best Security Search
Ransomware

How to Remove .Mole Virus File and Recover Encrypted Data

The .mole virus file is a strain of another ransomware that has been recently detected to be spread via malspam messages. This particular ransomware is of a crypto type and aims to encrypt valuable user data. For the encryption it utilizes the strong RSA-1024 encipher algorithm and afterward appends the malicious suffix .mole as a new file extension. Furthermore, the .mole virus performs various system modifications to establish the malicious files that allow it to compromise the system. Finally, it drops a ransom note file called INSTRUCTION_FOR_HELPING_FILE_RECOVERY.TXT that incites victims to contact crooks at [email protected] or [email protected] There is no exact information about what they demand from victims for the decryption key; however, ransomware infections are usually triggered to extort money from the victims.

mole virus file ransom note INSTRUCTION_FOR_HELPING_FILE_RECOVERY TXT

This article contains instructions on how to remove .mole virus file from the infected computer and recover encrypted data.

Distribution Techniques of .Mole Virus File

The ransomware payloads are primarily distributed via spam email campaigns that may be disseminated worldwide. The email subject line, sender, text message, and provided links or attachments may be different for every single email.

A recent report made by the malware analysist Brad Duncan reveals picky details about .mole virus distribution. Many malspam campaigns that push the ransomware were impersonating the United States Postal Service (USPS). Most of them inform about a delivery problem and point out a link to follow. It is supposed that the link will provide additional information on the case, however, it lands on fake Microsoft Office portal pages with Google Docs URLs hidden in a button. The button is following a text that states:

“This document cannot be read in your browser.
Download and install the latest plugin version.”

A click on the button initiates the download of an executable file from a Google Doc URL. Actually, the .mole ransomware virus is disguised as an Office plugin, and the infection process starts once it lands on the computer. The detected and analyzed executable files that trigger the .mole ransomware infection are named plugin-office.exe and pluginoffice.exe.

As other ways of .mole ransomware distribution may be used messages and posts on social networks and freeware bundling practices. So beware, the .mole virus may be stalking you.

Spicy news:

Could you recognize the threat?

Our team has received an email from a user who is using the [email protected] address. The email impersonates the “USPS Ground Support” and the subject line reads – “Official letter from USPS support team”. The sender is trying to convince us that we have ordered a product that wasn’t delivered to our address. However, this it is certainly not true, and the aim of this email is to trick us into following a link provided in the message.

usps support team scam email send to bestsecuritysearch mole ransomware distribution

It was more than obvious that we had received a spam email that is distributing a corrupted link that is likely to install malware on the PC if entered. Furthermore, we know that the .mole ransomware propagators impersonated the USPS services in several of their attack campaigns. So, we have recognized the scam and prevent an eventual infection with ransomware. By sharing our experience, we hope that it will be easier for our readers to recognize the threat. Being informed is a sure way to stay a step ahead of the malware.

.Mole Virus File Mass Email Spam Campaign Details

The latest email spam campaign is associated with counterfeit USPS delivery reports and other information that is commonly used by the service. The hackers utilize several templates. The messages are generated automatically and follow a predefined model:

  1. The hackers send out links that lead to a malicious site.
  2. The site automatically redirects to to another domain where a counterfeit Word Online site is displayed to the victims.
  3. A ZIP archive is generated and downloaded to the victim computer.
  4. The zip archive contains a malicious script which installs the .Mole virus payload.

A key characteristic of the spread campaign is that it uses a redirection domain (servivedelivery.com) that may look legitimate to some users. The links from the emails total 30 different domains and 2 separate counterfeit Word Online instances. There are several partial URLs that the malware researchers were able co extract that use the country codes of Poland (pl), Belgium (be) and Romania (ro). They are used for deploying additional malware to the targets.

Details of .Mole Virus File

The infection of .mole virus starts at the moment when a malicious executable file named plugin-office.exe or pluginoffice.exe is running on the computer. These files are designed to exploit unpatched vulnerabilities in the operating system and the installed apps. Once the ransomware’s payloads compromise the machine, it performs various system modifications like the creation of new registry entries and installation of further malicious files. In addition, it spawns a lot of processes. Unfortunately, the .mole virus doesn’t pass the vssadmin.exe process. By entering the commandline:

Vssadmin.exe delete shadows /all /quiet

.mole crypto virus deletes all saved shadow volume copies which are a form of backup and eliminates the possibility of file recovery via Shadow Explorer.
The ransomware has a built-in encryption module that employs RSA-1024 encryption to all target files. The corrupted files receive the malicious extension .mole and remain inaccessible until the unique private key generated during the encoding process is applied. As a result of .mole crypto virus contamination sensitive data like documents, text files, images, photos, music, projects, archives, videos, MS Office files, etc. are likely to be enciphered.

The analyses of .mole virus samples reveal that it also creates new registry entries. To be more persistent the ransomware creates custom Windows registry values in the following sub-keys:

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

Modifications in these registry keys allow .mole virus to run its malicious executable files every time when Windows is started.

Victims will also notice a text file named INSTRUCTION_FOR_HELPING_FILE_RECOVERY.TXT dropped on their desktop and any directory with encrypted files. The file contains decryption instructions left by the crooks. The whole ransom note text reads:

All your important files were encrypted on this computer.
You can verify this by click on see files an try open them.
Encryption was produced using unique public key RSA-1024 generated for this cmputer.
To decrypt files, you need to obtain private key.
The single copy of the private key, with will allow you to decrypt the files, is locate on a secret server on the internet.
The server will destroy the key within 78 hours after encryption completed.
To retrieve the private key, you need to Contact us by email, send us an email your DECRYPT-ID-*****-***-***-***-******** number and wait for further instructions.
For you to be sure, that we can decrypt your files – you can send us a single encrypted file and we will send you back it in a decrypted form.
Please do not waste your time! You have 72 hours only! After that The Main Server will double your price!
E-MAILS ADRESS:
[email protected]
[email protected]

Cyber criminals are trying to urge victims into sending an email with the unique decrypt ID to [email protected] or [email protected] and wait for further instructions. The typical scenario includes the distortion of a ransom in BTC transferred to a predefined address. Once this happens, they probably will deliver the decryption key. For the sake of their security, we advise all victims of .mole ransomware to avoid any negotiations with the crooks. The instructions below serve as a step-by-step guide through the .mole virus removal process. When the threat is in the past, there are alternative data recovery approaches pointed at STEP VI: Recover Encrypted Files.

Notice!
A backup of all encrypted files is required as a way to prevent the complete data loss.

Summary of .Mole Virus File

 


Name
.Mole virus strain

File Extension
.mole

Ransom
Varies

Easy Solution
You can skip all steps and remove .Mole Virus ransomware with the help of an anti-malware tool.

Manual Solution
.Mole Virus ransomware can be removed manually, though it can be very hard for most home users. See the detailed tutorial below.

Distribution
Spam emails, malicious URLs, malicious attacments, exploit kits, freeware.

.Mole Virus Removal

STEP I: Start the PC in Safe Mode with Network
This will isolate all files and objects created by the ransomware so they will be removed efficiently.

    1) Hit WIN Key + R

Windows-key-plus-R-button-launch-Run-Box-in-Windows-illustrated

    2) A Run window will appear. In it, write “msconfig” and then press Enter
    3) A Configuration box shall appear. In it Choose the tab named “Boot
    4) Mark “Safe Boot” option and then go to “Network” under it to tick it too
    5) Apply -> OK

Or check our video guide – “How to start PC in Safe Mode with Networking

STEP II: Show Hidden Files

    1) Open My Computer/This PC
    2) Windows 7

      – Click on “Organize” button
      – Select “Folder and search options
      – Select the “View” tab
      – Go under “Hidden files and folders” and mark “Show hidden files and folders” option

    3) Windows 8/ 10

      – Open “View” tab
      – Mark “Hidden items” option

    show-hidden-files-win8-10

    4) Click “Apply” and then “OK” button

STEP III: Enter Windows Task Manager and Stop Malicious Processes

    1) Hit the following key combination: CTRL+SHIFT+ESC
    2) Get over to “Processes
    3) When you find suspicious process right click on it and select “Open File Location
    4) Go back to Task Manager and end the malicious process. Right click on it again and choose “End Process
    5) Next you should go folder where the malicious file is located and delete it

STEP IV: Remove Completely .Mole Virus Ransomware Using SpyHunter Anti-Malware Tool

Manual removal of .Mole Virus requires being familiar with system files and registries. Removal of any important data can lead to permanent system damage. Prevent this troublesome effect – delete .Mole Virus with the help of a malware removal tool.

SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter

STEP V: Repair Windows Registry

    1) Again type simultaneously the Windows Button + R key combination
    2) In the box, write “regedit”(without the inverted commas) and hit Enter
    3) Type the CTRL+F and then write the malicious name in the search type field to locate the malicious executable
    4) In case you have discovered registry keys and values related to the name, you should delete them, but be careful not to delete legitimate keys

Further help for Windows Registry repair

STEP VI: Recover Encrypted Files

    1) Use present backups
    2) Use professional data recovery software

      Stellar Phoenix Data Recovery – a specialist tool that can restore partitions, data, documents, photos, and 300 more file types lost during various types of incidents and corruption.
      Data Recovery Pro by ParetoLogic – a Microsoft Partner program that is very powerful. It can recover not only local files but also deleted emails and connected drives.
    3) Using System Restore Point

      – Hit WIN Key
      – Select “Open System Restore” and follow the steps


restore-files-using-system-restore-point

    4) Restore your personal files using File History

      – Hit WIN Key
      – Type “restore your files” in the search box
      – Select “Restore your files with File History
      – Choose a folder or type the name of the file in the search bar

    restore-your-personal-files-using-File-History-bestecuritysearch

      – Hit the “Restore” button

STEP VII: Preventive Security Measures

    1) Enable and properly configure your Firewall.
    2) Install and maintain reliable anti-malware software.
    3) Secure your web browser.
    4) Check regularly for available software updates and apply them.
    5) Disable macros in Office documents.
    6) Use strong passwords.
    7) Don’t open attachments or click on links unless you’re certain they’re safe.
    8) Backup regularly your data.
For a faster solution, you can run a scan with an advanced malware removal tool and delete .Mole Virus completely with a few mouse clicks.

SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter

Gergana Ivanova

Gergana Ivanova is computer security enthusiast. She is a member of Best Security Search team and enjoys presenting the latest news on cyber-security and cyber-threat issues.