Marlboro Ransomware

## Marlboro Ransomware Overview

The Marlboro Ransomware which is also known as the Oops Ransomware (attributed to its .oops extension) is a dangerous malware that uses the AES cipher to encrypt target user file. It targets the following file type extensions:

*.mid, .wma, .flv, .mkv, .mov, .avi, .asf, .m peg, .vob, .mpg, .wmv, .fla, .swf, .wav, .mp3, .qcow2, .vdi, .vmdk, .vmx, .gpg, .aes, .ARC, .PAQ, .tar, .bz2, .tbk, .bak, .tar, .t z, .rar, .zip, .djv, .djvu, .svg, .bmp, .png, .gif, .raw, .com, .jpeg, .jpg, .tif, .tiff, .NEF, .psd, .cmd, .bat, .class, .jar, .java, .asp, .aspx, .brd, .sch, .dch, .dip, .vbs, .asm, .pas, .cpp, .php, .ldf, .mdf, .ibd, .MYI, .MYD, .frm, .odb, .dbf, .mdb, .sql, .SQLITEDB, .SQLITE3, .asc, .lay6, .lay, .ms11, .sldm, .sldx, .ppsm, .ppsx, .ppam, .docb, .mml, .sxm, .otg, .odg, .uop, .potx, .potm, .pptx, .pptm, .std, .sxd, .pot, .pps, .sti, .sxi, .otp, .odp, .wks, .xltx, .xltm, .xlsx, .xlsm, .xlsb, .slk, .xlw, .xlt, .xlm, .xlc, .dif, .stc, .sxc, .ots, .ods, .hwp, .dotm, .dotx, .docm, .docx, .DOT, .max, .xml, .txt, .csv, .not, .RTF, .pdf, .XLS, .PPT, .stw, .sxw, .Ott, .odt, .DOC, .pem, .csr, .crt, .key, .dat*

## Marlboro Ransomware Ransom Note

After the encryption process is complete a ransomware note with the name **\_HELP\_Recover\_Files\_.html** is crafted. It contains the following message:

```
!!! IMPORTANT INFORMATION !!!

All of your files are encrypted with RSA-2048 and AES-128 ciphers.
More information about RSA and AES can be found here:
https://en.wikipedia.org/wiki/RSA\_(cryptosystem)
https://en.wikipedia.org/wiki/Advanced\_Encryption\_Standard

Decrypting of your files is only possible with private key and decrypt program, which is on our secret server.
To receive your private key you need to make payment to us.
After you make payment run program called 'DecryptFiles' that is located on your Desktop and your Documents.
Program will automatically decrypt all of your files!

If you try to decrypt files with another software your files can be forever lost.

How to buy decrypter?

1. You can make a payment with BitCoins, there are many methods to get them.

2. You should register BitCoin Wallet

3. Purchase Bitcoins - Althought it is not very easy to buy bitcoins, it is getting simpler every day.

Here are our recommendations:

Localbitcoins.com (WU) - Buy Bitcoins with Western Union
Coincafe.com - Recommended for fast, simple service.
Localbitcoins.com Service allows you to search for people in your community willing to sell bitcoins to you directly.
CEX.IO - Buy Bitcoins with VISA/MASTERCARD or Wire Transfer
btcdirect.eu - THE BEST FOR EUROPE

4. Send 0.2 BTC to Bitcoin address:

5. After you make payment, run program called 'DecryptFiles'that is located on your Desktop and your Documents.
Program will automatically decrypt all of your files!

```

## Marlboro Ransomware Distribution

The Marlboro ransomware mainly targets Serbian-speaking users. The majority of the infections are done through payload downloaders that are bundled with various software bundles or updates.

## Marlboro Ransomware Removal

In-depth removal instructions and detailed technical information about the virus can be found on Best Security Search.