DORRA Ransomware: Another Threat From Makop Family

What is DORRA Ransomware?

DORRA Ransomware is another variant within the Makop ransomware family. Similar threats include Reload Ransomware and Datah Ransomware.
This malicious software aims to lock victims out of their own files by encrypting them, thus preventing access. DORRA Ransomware exhibits typical ransomware behavior with some distinctive features. Once it infiltrates a system, it encrypts files and renames them, adding a unique identifier and an email address to the filenames, along with the ".DORRA" extension. For example, a file named "picture.png" becomes "picture.png.[2AF20FA3].[dorradocry@outlook.com].DORRA".

How DORRA Operates

Upon encryption, DORRA Ransomware drops a ransom note titled "+README-WARNING+.txt" into the affected directories. This note is a grim notification to the victims, informing them that their files have been encrypted and stolen. It warns against decrypting the files independently, as this could corrupt them beyond recovery. The note instructs the victims to contact the attackers via the provided email address, threatening that failure to comply will result in the public release of the stolen data. To initiate communication, the victims are required to send their unique ID, which is embedded in the filenames, to receive further instructions on decrypting their files.

The text from the ransom note:

Your files are encrypted and an important part of your data is stolen!!!
If you try to decrypt the files yourself, they may be corrupted and this may lead to the loss of your files!

You need to contact us at this email address: dorradocry@outlook.com
If we do not receive a response from you, your data will end up on the Internet.

Send me ID, which is indicated in the name of your files,
and you will receive instructions on how to decrypt all files.
Do not ignore this message, contact us as soon as possible to quickly get your files back.

Ransomware Goals

Ransomware, including DORRA, is designed with one primary objective: extortion. Cybercriminals create a sense of urgency and desperation by encrypting crucial files and demanding a ransom for their release. Typically, these demands are made in cryptocurrency to maintain anonymity. Unfortunately, even if the victims comply and pay the ransom, there is no guarantee that the decryption tools will be provided. Many victims end up being scammed, with no way to recover their files unless they have pre-existing backups or can find third-party decryption tools.

Ransomware Removal and Recovery

The presence of ransomware on a system is a serious issue that necessitates immediate action. Simply paying the ransom is not recommended, as it often leads to further scams without resolving the issue. Instead, victims should focus on removing the ransomware from their systems to prevent additional encryptions and potential infections across connected networks. The best strategy for recovery involves restoring files from backups or using legitimate decryption tools if available. Ensuring that the ransomware is completely eradicated from the system is crucial to avoid future attacks.

What Ransomware Programs Do

Ransomware is a type of malware cybercriminals use to extort money from individuals or organizations. These programs typically encrypt the victim's files and then demand a ransom for the decryption key. In addition to encryption, ransomware often renames files, making it difficult to recognize the original content. The encryption is usually strong enough that decryption without the key provided by the attackers is virtually impossible.

To protect against such attacks, it is vital to maintain regular backups of important data, preferably stored on remote servers or offline storage devices. This precaution ensures that even if a system is compromised, the data can be restored without paying a ransom.

How Does Ransomware Infect Computers?

Ransomware can infiltrate computers through various means. Cybercriminals often employ deceptive tactics, such as sending emails containing malicious files or links. These emails may appear legitimate, luring users into downloading the malware. Other common methods include distributing ransomware via pirated software, malicious advertisements, compromised websites, and technical support scams. Peer-to-peer networks, third-party downloaders, and free file hosting pages are frequent sources of ransomware infections.

Attackers also exploit vulnerabilities in operating systems or installed software. Sometimes, ransomware can spread through infected USB drives. To minimize the risk of infection, users should avoid opening suspicious emails or downloading software from untrusted sources. Additionally, steering clear of questionable websites and not interacting with pop-ups or ads can help protect against ransomware attacks.

Final thoughts

DORRA Ransomware is a significant threat within the Makop Ransomware family, exemplifying the dangers posed by ransomware attacks. By encrypting and renaming files, DORRA Ransomware effectively locks victims out of their own data, demanding a ransom for its release. Understanding the infection methods and adopting preventative measures, such as regular data backups and cautious online behavior, are crucial in safeguarding against these malicious attacks. If infected, prioritizing the removal of the ransomware and seeking alternative recovery solutions rather than paying the ransom is essential for mitigating the impact of such threats.