A new variant of ransomware virus has been discovered by IT security specialists. It appends the .muslat file extension to encrypted files. This ransomware targets computers running Microsoft Windows by spam emails, malware or manually installing the ransomware. Here’s everything you need to know about this ransomware, how to remove Muslat crypto malware and how to restore (decrypt) encrypted photos, documents and music for free.
Files encrypted by .muslat ransomware
Muslat virus is a malware that limits you from accessing your personal files. It forces you to pay the ransom through Bitcoins in order to get your documents, photos and music back. It can encrypt almost all types of files, including common as:
.wcf, .txt, .vpp_pc, .wpw, .z3d, .xlsx, .gdb, .zw, .epk, .dng, .wire, .gho, .p7b, .t13, .sb, .pak, .zdc, .xlk, .z, .arw, .xld, .avi, .svg, .wbd, .wsd, .css, .0, .odt, .xll, .odb, .wma, .pfx, .lrf, .dbf, .accdb, .eps, .sav, .ai, .wsc, .mpqge, .ybk, .odm, .bc7, .yal, .flv, .psd, .nrw, .wp5, .kf, .d3dbsp, .das, .db0, .xf, .cfr, .zi, .wbc, .ncf, .mdbackup, .wpt, .xbplate, .wpl, .xyp, .1st, .apk, .sis, .docx, .wbz, .cdr, .qdf, .wps, .wdb, .zdb, .ppt, .jpe, .upk, .wpb, .xx, .xlsm, .ff, .wotreplay, .re4, .wgz, .xml, .asset, .bay, .wpe, .zif, .xyw, .ysp, .wb2, .wmv, .xlsx, .sum, .slm, .xdb, .esm, .vfs0, .xls, .bkp, .dwg, .pdd, .big, .2bp, .psk, .ptx, .pst, .m4a, .rwl, .wri, .ntl, .wpd, .rofl, .itm, .pdf, .3fr, .xlsm, .x, .iwi, .wmo, .wmf, .wav, .wbm, .ibank, .sr2, .syncdb, .csv, .sidd, .kdc, .odc, .vdf, .zip, .x3f, .blob, .lvl, .jpeg, .1, .ws, .7z, .3dm, .xlgc, .mov, .p7c, .wot, .wmd, .xmmap, .wm, .wps, .webp, .wsh, .xxx, .erf, .iwd, .t12, .cr2, .dba, .xlsb, .cas, .y, .fpk, .pptx, wallet, .menu, .wp4, .zabw, .rim, .rw2, .vcf, .doc, .wp, .3ds, .hkx, .hplg, .mddata, .crt, .x3f, .desc, .wp7, .yml, .sid, .mlx, .fos, .srw, .m3u, .litemod, .mdb, .hkdb, .der, .wp6, .lbf, .vtf, .raw, .rgss3a, .forge, .xy3, .pkpass, .webdoc, .kdb, .xdl, .png, .tor, .dmp, .wma, .wbmp, .rtf, .snx, .pem, .wpa, .cer, .xpm, .itl, .dcr, .xls, .jpg, .bik, .srf, .dazip, .r3d, .bar, .wbk, .layout, .raf, .x3d, .vpk, .fsh, .js, .xmind, .sql, .bsa, .mrwref, .xar, .crw, .hvpl, .orf, .dxg, .itdb, .zip, .p12, .docm, .bc6, .sie, .wn, .bkf, .xwp, .rar, .mp4, .indd, .arch00, .py, .xbdoc, .sidn, .tax, .w3x, .rb, .odp, .pef, .mcmeta, .qic, .wpg
Upon encryption, all encrypted files will then be appended with the .muslat extension (e.g., ‘photo.jpg is renamed to ‘photo.jpg.muslat’). Ransomware leaves a ransom demanding message called ‘_readme.txt’ with instructions for extortion and ransom payment, threatening destruction of files if payment is not made. The ransom demanding message directs victims to make payment online in Bitcoins.
Don't worry, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-BTtULebL7F Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.
Threat Summary
| Name | Muslat |
| Type | Crypto virus, Crypto malware, Filecoder, Ransomware, File locker |
| Encrypted files extension | .muslat |
| Ransom note | _readme.txt |
| Contact | gorentos@bitmessage.ch, gorentos@firemail.cc, @datarestore (telegram) |
| Ransom amount | $490, $980 in Bitcoins |
| Symptoms | Files won’t open. Windows Explorer displays a blank icon for the file type. Files called such as ‘_readme.txt’, ‘READ-ME’, ‘_open me’, _DECRYPT YOUR FILES’ or ‘_Your files have been encrypted” in every folder with an encrypted file. Desktop background is changed to the ransom note. |
| Distribution ways | Phishing email scam that attempts to scare users into acting impulsively. Exploit kits (cybercriminals use crypto malware packaged in an ‘exploit kit’ that can find a vulnerability in Web-browser, Microsoft Windows operating system, Adobe Flash Player, PDF reader). Social media posts (they can be used to entice users to download malware with a built-in ransomware downloader or click a suspicious link). Flash Drive and other removable media. |
| Removal | To remove Muslat ransomware use the removal guide |
| Decryption | To decrypt Muslat ransomware use the steps |
Use the step-by-step tutorial below to remove .Muslat virus and recover (decrypt) encrypted documents, photos and music for free.
Quick links
- How to remove Muslat crypto virus
- How to decrypt .muslat files
- Use STOPDecrypter to decrypt .muslat files
- How to restore .muslat files
- How to protect your computer from Muslat crypto virus?
- Finish words
How to remove Muslat ransomware virus
The following instructions will help you to remove Muslat crypto malware and other malware. Before doing it, you need to know that starting to get rid of the ransomware virus, you may block the ability to decrypt documents, photos and music by paying makers of the crypto virus requested ransom. Zemana Anti-malware, KVRT and Malwarebytes Anti-malware can detect different types of active ransomware infections and easily get rid of it from your computer, but they can not recover encrypted photos, documents and music.
Run Zemana Anti-malware to remove .Muslat virus
You can remove Muslat ransomware virus automatically with a help of Zemana Anti-malware. We recommend this malware removal utility because it may easily remove ransomware, trojans, adware and worms, spyware with all their components such as folders, files and registry entries.
Now you can install and use Zemana Anti-Malware to remove Muslat virus from your internet browser by following the steps below:
Visit the page linked below to download Zemana installer named Zemana.AntiMalware.Setup on your PC. Save it on your Desktop.
164107 downloads
Author: Zemana Ltd
Category: Security tools
Update: July 16, 2019
Start the setup file after it has been downloaded successfully and then follow the prompts to set up this utility on your machine.
During install you can change certain settings, but we suggest you don’t make any changes to default settings.
When installation is done, this malicious software removal tool will automatically start and update itself. You will see its main window as shown in the figure below.
Now click the “Scan” button for scanning your computer for the Muslat crypto virus, other malicious software, worms and trojans. A system scan can take anywhere from 5 to 30 minutes, depending on your PC. During the scan Zemana Free will scan for threats exist on your PC system.
Once Zemana Anti-Malware has completed scanning your computer, Zemana AntiMalware (ZAM) will show a scan report. Review the report and then click “Next” button.
The Zemana will remove Muslat ransomware, other kinds of potential threats and move items to the program’s quarantine. After the cleaning procedure is done, you can be prompted to restart your machine to make the change take effect.
How to remove Muslat with MalwareBytes Anti-Malware (MBAM)
If you are having problems with the Muslat virus removal, then download MalwareBytes. It is free for home use, and scans for and deletes various malware that attacks your PC or degrades PC performance. MalwareBytes Anti Malware can delete adware, spyware, worms as well as malicious software, including ransomware and trojans.
- MalwareBytes Free can be downloaded from the following link. Save it directly to your Microsoft Windows Desktop.
Malwarebytes Anti-malware
326460 downloads
Author: Malwarebytes
Category: Security tools
Update: April 15, 2020
- At the download page, click on the Download button. Your internet browser will display the “Save as” prompt. Please save it onto your Windows desktop.
- Once the download is done, please close all software and open windows on your computer. Double-click on the icon that’s called mb3-setup.
- This will start the “Setup wizard” of MalwareBytes Free onto your PC. Follow the prompts and do not make any changes to default settings.
- When the Setup wizard has finished installing, the MalwareBytes Anti-Malware will run and show the main window.
- Further, click the “Scan Now” button . MalwareBytes Free tool will begin scanning the whole personal computer to find out Muslat crypto virus, other kinds of potential threats like malicious software and trojans. A system scan can take anywhere from 5 to 30 minutes, depending on your computer. While the utility is scanning, you may see number of objects and files has already scanned.
- After MalwareBytes AntiMalware has finished scanning, MalwareBytes Free will open a list of all items detected by the scan.
- Review the scan results and then press the “Quarantine Selected” button. After the cleaning process is finished, you may be prompted to restart the computer.
- Close the Anti-Malware and continue with the next step.
Video instruction, which reveals in detail the steps above.
Use KVRT to delete Muslat ransomware from the PC
KVRT is a free removal tool that can be downloaded and run to remove ransomware viruses, adware, malware, trojans and other threats from your PC. You can run this utility to scan for threats even if you have an antivirus or any other security program.
Download Kaspersky virus removal tool (KVRT) from the following link.
129082 downloads
Author: Kaspersky® lab
Category: Security tools
Update: March 5, 2018
After downloading is finished, double-click on the Kaspersky virus removal tool icon. Once initialization procedure is done, you’ll see the KVRT screen as displayed on the screen below.
Click Change Parameters and set a check near all your drives. Press OK to close the Parameters window. Next press Start scan button to perform a system scan for the Muslat ransomware virus and other trojans and malicious applications. Depending on your computer, the scan can take anywhere from a few minutes to close to an hour. During the scan Kaspersky virus removal tool will look for threats exist on your PC system.
Once that process is finished, KVRT will produce a list of undesired programs adware as displayed in the following example.
Make sure all items have ‘checkmark’ and press on Continue to begin a cleaning task.
How to decrypt .muslat files
The Muslat ransomware encourages to make a payment in Bitcoins to get a key to decrypt photos, documents and music. Important to know, currently not possible to decrypt .muslat files without the private key and decrypt program.
Never pay the ransom! You might feel that you have no other choice but to pay up and decrypt .muslat photos, documents and music quickly. There is no guarantee that the authors of Muslat ransomware virus will live up to the word and give back your files.
With some variants of the Muslat ransomware, it is possible to decrypt or restore encrypted files using free tools such as STOPDecrypter, ShadowExplorer and PhotoRec.
Use STOPDecrypter to decrypt .muslat files
Michael Gillespie (@) released a free decryption tool named STOPDecrypter (download from download.bleepingcomputer.com/demonslay335/STOPDecrypter.zip).
STOPDecrypter
STOPDecrypter has been updated to include decryption support for the following .djvu* variants (.djvu, .djvuu, .udjvu, .djvuq, .djvur, .djvut, .pdff, .tro, .tfude, .tfudeq, .tfudet, .rumba, .adobe, .adobee, .blower, .promos, .dotmap. STOPDecrypter will work for any extension of the Djvu* variants including new extensions (.muslat).
Please check the twitter post for more info.
How to restore .muslat files
In some cases, you can recover files encrypted by Muslat ransomware virus. Try both methods. Important to understand that we cannot guarantee that you will be able to restore all encrypted photos, documents and music.
Recover .muslat encrypted files using Shadow Explorer
If automated backup (System Restore) is enabled, then you can use it to recover all encrypted files to previous versions.
Click the following link to download the latest version of ShadowExplorer for MS Windows. Save it directly to your Microsoft Windows Desktop.
438809 downloads
Author: ShadowExplorer.com
Category: Security tools
Update: September 15, 2019
After downloading is finished, open a directory in which you saved it. Right click to ShadowExplorer-0.9-portable and select Extract all. Follow the prompts. Next please open the ShadowExplorerPortable folder as shown below.
Double click ShadowExplorerPortable to start it. You will see the a window as displayed on the screen below.
In top left corner, select a Drive where encrypted photos, documents and music are stored and a latest restore point as displayed below (1 – drive, 2 – restore point).
On right panel look for a file that you want to recover, right click to it and select Export as displayed on the screen below.
Restore .muslat files with PhotoRec
Before a file is encrypted, the Muslat ransomware virus makes a copy of this file, encrypts it, and then deletes the original file. This can allow you to recover your personal files using file restore programs like PhotoRec.
Download PhotoRec by clicking on the link below. Save it on your MS Windows desktop.
When the downloading process is complete, open a directory in which you saved it. Right click to testdisk-7.0.win and select Extract all. Follow the prompts. Next please open the testdisk-7.0 folder as displayed on the screen below.
Double click on qphotorec_win to run PhotoRec for Windows. It’ll show a screen as shown on the screen below.
Choose a drive to recover as shown in the following example.
You will see a list of available partitions. Select a partition that holds encrypted documents, photos and music as shown in the figure below.
Click File Formats button and select file types to restore. You can to enable or disable the recovery of certain file types. When this is complete, click OK button.
Next, click Browse button to select where recovered files should be written, then click Search.
Count of restored files is updated in real time. All restored personal files are written in a folder that you have selected on the previous step. You can to access the files even if the recovery process is not finished.
When the recovery is finished, click on Quit button. Next, open the directory where restored photos, documents and music are stored. You will see a contents as displayed below.
All restored photos, documents and music are written in recup_dir.1, recup_dir.2 … sub-directories. If you’re looking for a specific file, then you can to sort your restored files by extension and/or date/time.
How to protect your computer from Muslat crypto virus?
Most antivirus applications already have built-in protection system against the ransomware virus. Therefore, if your computer does not have an antivirus application, make sure you install it. As an extra protection, run the HitmanPro.Alert.
Run HitmanPro.Alert to protect your computer from Muslat crypto malware
All-in-all, HitmanPro.Alert is a fantastic tool to protect your machine from any ransomware. If ransomware is detected, then HitmanPro.Alert automatically neutralizes malware and restores the encrypted files. HitmanPro.Alert is compatible with all versions of Windows OS from Windows XP to Windows 10.
HitmanPro.Alert can be downloaded from the following link. Save it to your Desktop so that you can access the file easily.
After the download is finished, open the file location. You will see an icon like below.
Double click the HitmanPro.Alert desktop icon. Once the tool is started, you’ll be shown a window where you can choose a level of protection, like below.
Now click the Install button to activate the protection.
Finish words
Now your machine should be free of the Muslat crypto virus. Remove MalwareBytes Anti-Malware and KVRT. We recommend that you keep Zemana AntiMalware (ZAM) (to periodically scan your computer for new malware). Moreover, to prevent ransomware, please stay clear of unknown and third party software, make sure that your antivirus program, turn on the option to stop or search for ransomware.
If you need more help with Muslat ransomware related issues, go to here.
Please help me. .muslat file extension to encrypted files.
Use STOPDecrypter to decrypt .muslat files
Please help to decrypt my .muslat file, STOPDecrypter v2.1.0.13 does not work. help help!!!
No key for ID: zbDPXbPbJJKsBFBB9ZnWCZp2pZ6nR9AFXgJdynyL (.muslat )
[+] Loaded 46 offline keys
Please archive the following info in case of future decryption:
[*] MACs: 00:1C:C0:63:DB:3D
This info has also been logged to STOPDecrypter-log.txt
Selected directory: K:\Holycross-file\Class-1
Starting decryption…
[+] File: K:\Holycross-file\Class-1\adim Manus.ai.muslat
[-] No key for ID: zbDPXbPbJJKsBFBB9ZnWCZp2pZ6nR9AFXgJdynyL (.muslat )
[+] File: C:\Users\pc\Desktop\ttt\গাহস্থ-শিশু-বিকাশে-খেলাধুলা.ai.muslat
[-] No key for ID: zbDPXbPbJJKsBFBB9ZnWCZp2pZ6nR9AFXgJdynyL (.muslat )
STOPDecrypter does not work! Please Help