Core (Makop) Ransomware: A Threat Analysis and Removal Guide

Ransomware is one of the most destructive types of malware, and the Core ransomware—belonging to the Makop family—is no exception. This cyber threat encrypts files on infected systems and demands a ransom for their decryption. Victims of Core ransomware find their files renamed with a unique ID, an attacker’s email address, and the “.core” extension. Furthermore, a ransom note, “+README-WARNING+.txt“, appears, warning victims that their files are both encrypted and stolen.

Core (Makop) Ransomware Threat Overview

The table below summarizes the key details of Core (Makop) ransomware:

Attribute	Details
Threat Name	Core (Makop) ransomware
Threat Type	Ransomware, Crypto Virus, File Locker
Encrypted File Extension	.core (appended with unique ID and attacker’s email)
Ransom Note File	+README-WARNING+.txt
Cybercriminal Contact	corecrypt@hotmail.com
Detection Names	Avast (Win32:Fasec [Trj]), Combo Cleaner (Gen:Variant.Ransom.Makop.50), ESET-NOD32 (A Variant Of Win32/Filecoder.Phobos.E), Kaspersky (HEUR:Trojan-Ransom.Win32.Generic), Microsoft (Ransom:Win32/Phobos.PB!MTB)
Symptoms of Infection	Files cannot be opened, file extensions changed to .core, ransom note displayed, demand for payment in cryptocurrency
Damage	Encrypts all files, rendering them inaccessible; potential installation of additional malware (password stealers, trojans, etc.)
Distribution Methods	Infected email attachments, torrent sites, malicious ads, fake software updates, pirated software
Danger Level	High

---

Ransom Note Message

Below is the exact message that victims receive in the +README-WARNING+.txt file:

!i!i!i!i!i!i!i!i!i!!i!i!i!i!i!i!i!i!i!i!i!i!i

Your files are ENCRYPTED and STOLEN!

Trying to decrypt data in any other way may result in file corruption and data loss.
You can find a mediator to make a deal with us,
but we don't guarantee the security of the deal between you and the mediator.

Contact us at this email address: corecrypt@hotmail.com
Send me ID, which is indicated in the name of your files,
You will receive instructions to resolve this situation.

---

How Core (Makop) Ransomware Infects Your Computer

Core (Makop) ransomware spreads primarily through phishing emails, malicious attachments, and fake software downloads. Common infection vectors include:

• Email Attachments: Malware-laced documents (Word, Excel, PDFs) often contain malicious macros that execute the ransomware upon opening.
• Pirated Software: Downloading cracked software from unreliable sources can introduce malware.
• Drive-by Downloads: Compromised websites inject malware into visitors’ systems.
• Malvertising: Fake advertisements redirect users to malicious sites.
• Trojan Downloaders: Some malware infections act as a gateway to install Core ransomware.

---

How to Remove Core (Makop) Ransomware?

Although removing the ransomware will not decrypt affected files, it is crucial to eliminate it to prevent further damage. Follow these steps:

Step 1: Enter Safe Mode with Networking

1. Restart your PC and press F8 (Windows 7) or hold Shift + Restart (Windows 10/11) before booting.
2. Select Safe Mode with Networking.

Step 2: Install and Run SpyHunter

1. Download SpyHunter.
2. Open the downloaded file and follow the installation steps.
3. Run a full system scan to detect and remove Core ransomware.
4. Click Fix Threats to remove identified threats.

Step 3: Delete Suspicious Files from Your System

1. Press Ctrl + Shift + Esc to open Task Manager.
2. Find any unknown or suspicious processes, right-click, and select End Task.
3. Go to C:\Users\[YourUsername]\AppData\Local\Temp and delete suspicious files.

Step 4: Remove Ransomware Entries from Registry

1. Press Win + R, type regedit, and hit Enter.
2. Navigate to: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
3. Delete any suspicious entries referencing unknown executables.

Step 5: Restore Files (If Backups Exist)

If you have backups, restore files from an external drive or cloud storage.

---

Preventing Future Ransomware Infections

To protect your system from ransomware attacks, follow these best practices:

• Backup Your Data Regularly: Store backups on external drives and cloud storage.
• Use Reliable Security Software: Install anti-malware tools like SpyHunter to detect threats early.
• Avoid Suspicious Emails: Do not open attachments or click links from unknown senders.
• Enable File Extensions: Windows hides extensions by default; enabling them helps identify malicious files (e.g., .pdf.exe).
• Use Strong Passwords: Secure your accounts with unique, strong passwords.
• Keep Software Updated: Regularly update your operating system and applications to patch vulnerabilities.
• Disable Macros in Office Documents: Microsoft Office macros are a common attack vector.
• Use a Firewall: A properly configured firewall can block malicious connections.

---

Conclusion

Core (Makop) ransomware is a severe threat that encrypts data and demands payment for decryption. However, paying the ransom is highly discouraged as there is no guarantee of file recovery. The best approach is to remove the malware using SpyHunter, restore data from backups, and implement strict cybersecurity measures to prevent future infections.

If you are still having trouble, consider contacting remote technical support options.