Simple Steps: How to Remove Mora Project Ransomware & Restore Files Having ‘.ENCRYPTED’ Extension


Analysis on Mora Project Ransomware

Mora Project Ransomware (also infamous as Ransom_HiddenTearMORA.A) is a real file encoder virus which appends '.ENCRYPTED' extension to encrypted files and displays ransom message saved in 'ReadMe_Important.txt file onto your compromised Desktop. According to the note, your files are encoded with a very strong hashing algorithm using a password stored in private server. Though, if you wish to gain access to your important files then you need to pay off 40,000 USD in Bitcoin. You should know that it's not an small amount before transferring 16 BTC to threat actors Bitcoin wallet, you should try few alternative options that might be helpful in restoring your importants files including Videos, Images, Projects, Documents and more.

uninstall Mora Project Ransomware

Depth analysis revealed that Mora Project Ransomware is mainly aimed at infecting servers and then server administrators. Hence, relevant computer system should be protected with an efficient Antimalware software. Currently, its developers are unable to start campaigns like WannaCry ransomware developers have already started. If you pay of ransom 40,000 USD then it work like a fuel for them to continuous development of more variants based th Mora Project Ransomware. Furthermore, you should know that if your computer is literally infected with Mora Project virus then you might find moraproject.exe running in the backend as service. Even, your important files saved on local disk, mounted drives or network shared drives might be featuring '.ENCRYPTED' extension. Moreover, your Antivirus software might detect following threats onto your PC:

  • TR/AD.HiddenTear.gmumr

  • Trojan.Ransom.HiddenTears.1

  • Trojan ( 700000121 )

  • W32/Trojan.UXTK-3354

  • malicious_confidence_100% (W)

  • MSIL/Filecoder.HF

  • Ransom:Win32/HiddenTear.gen

What Action You Should Take Next?

First of all, you should remove Mora Project Ransomware from your computer using specific guideline provided in this article. Next, instead paying of ransom, you should make use of other methods like using Professional Data Recovery software or System restore point to get back your enciphered files. At the time of writing the article AV vendors haven't released any Free Decryptor though you need to wait till they release it for Windows users.


Step A: Rip Out Mora Project Ransomware From Safe Mode

Step B: Using System Restore

Step C: Using File Recovery Software

Step D: Restore Copied Copies Of Encrypted Data In The Background

Follow Steps to Get Rid Of Mora Project Ransomware From OS

Step A: How to Start OS in Safe Mode with Network In order to isolate files and entries created by Mora Project Ransomware, users need to follow the below mentioned steps.

  • Select WIN Key + R in Combination.

  • This will open a Run Window, Now Type sysconfig and hit on Enter.
  • Now a Configuration box will appear. Now select the Tab named as Boot.
  • Click and mark Safe Boot option >> go to Network.
  • In order to Apply the settings, Select on OK.

Step B: How To Restore System During Mora Project Ransomware Attack

Still, if you are facing problem in rebooting OS in Safe mode, opt for System Restore. Follow the steps given below. Prss F8 continously until you get Windows Advanced Options Menu on Computer Monitor. Now Choose Safe Mode with Command Prompt Option and Tap enter.

  • In the Command Prompt Windows, you need to type this command : cd restore and Select Enter system-restore-1

  • Now type rstrui.exe as command and press on Enter.

  • This will open a new window to Restore System Files and Settings. Click on Next to proceed.

  • Restore Point is to be selected from the date you want to restore back your system as it was earlier to Mora Project Ransomware attack.

Step C: Another method for recovering your decrypted files are by using file recovery software

If above methods are not successful you can go for file recovery software. It can be helpful in recovering your encrypted files as Mora Project Ransomware first makes a copy of original files and then encrypt it. After encryption it Get Rid Ofs the original files. So there is high probability that these file recovery software can help you in recovering your original files.

Step D: Know How To Restore Shadow Copies of Encrypted Data

In certain cases, if Mora Project Ransomware has not Get Rid Ofd the Shadow Copies of the data then it can be easily restored using ShadowExplorer. (Know how to install and use ShadowExplorer).