Home Malware Programs Ransomware DNRansomware


Posted: January 23, 2017

Threat Metric

Threat Level: 8/10
Infected PCs: 16
First Seen: January 23, 2017
Last Seen: April 24, 2020
OS(es) Affected: Windows

The DNRansomware or DoNotOpen Ransomware is a Trojan that enciphers your files with an AES algorithm so that you can't open them. Since the DNRansomware demands a ransom for what is a non-working decryptor currently, malware experts recommend using other recovery options such as restoring from your latest backup. In ideal circumstances, your anti-malware protection should catch and delete the DNRansomware before it can begin locking your files.

Updating Your Browser into Trouble

Fraudulent updates are favorite infection vectors for many threat campaigns, by capitalizing on the trustworthiness of a known brand and also playing off of a victim's fear of harboring software vulnerabilities. The DNRansomware is one of the newest Trojans to use such a disguise, targeting Google's popular Chrome browser. However, once the victim installs it, they receive attacks that encrypt and lock their files instead of a security update to their Web browser.

Although the DNRansomware (and a closely-related, cloned threat, the 'Jhon Woddy' Ransomware) has some non-negligible issues with its payload, its most prime attacks are fully functional. The Trojan encrypts files on the infected PC that meet its directory and format requirements, locking data such as Word documents, PDFs, AVI movies or JPG pictures. It also may append either the '.fucked' or '.killedxxx' extensions to their names.

Like the 'M4N1F3STO Virus' Lockscreen, a Trojan it shares much of its code with, the DNRansomware also blocks the user's desktop access with its ransom message. The Trojan asks for a ransom to decrypt your files, with its payment demands ranging from 0.1 Bitcoin to 0.5 Bitcoin (between 92 and 461 USD). Victims should keep in mind that malware experts did confirm that the DNRansomware does not include a working decryption feature, which makes paying this fee entirely worthless for recovering any encrypted content.

What to Do After Opening What Should Leave Closed

The DNRansomware's alias of the 'Do Not Open Ransomware' is as apt a title as it is for most file-encrypting Trojans due to the lack of viable recovery options after the Trojan locks your files. Even though current samples of the DNRansomware lack decryption functionalities, malware experts have found its hard-coded decryption keys useful for terminating its screen-locking pop-up. Input either the '83KYG9NW-3K39V-2T3HJ-93F3Q-GT' or the 'M3VZ>5BwGGVH' code, if necessary, to regain access to other software and your desktop.

With no decryption solutions on offer for the DNRansomware, backing up your data before an infection is the only surefire way of reversing all encryption damages this threat inflicts. Although malware experts recommend against relying on local backups that the DNRansomware may delete automatically, backups saved elsewhere, such as on an external server or device, can give victims easy (and no-ransom) ways of recovering fully from an attack. Many anti-malware applications also may detect and delete the DNRansomware accurately before it can install itself.

In sharp contrast to what the DNRansomware would like you to believe, assuming that a Trojan is dealing with you honestly may be a poor idea. Before you pay, stop and consider what incentive a con artist might have to honor his word, particularly when any payments occur through non-revocable methods like Bitcoin.