RanRans Ransomware Description
The RanRans Ransomware is a Trojan that blocks you from opening media such as documents, pictures, or spreadsheets by encoding each file. It sells the data-unlocking feature for cryptocurrency payments, although malware experts advise against paying, especially since this threat's payload is buggy. Use backups or free decryption tools for unlocking any content that the Trojan damages, and delete the RanRans Ransomware with any standard anti-malware products.
A New Blossom from a Toxic Spring
While it does have competition, Hidden Tear is most likely still the most widely-abused resource for plundering to create minor variants of Trojans with encryption-based features turned towards extortion. One of the newer clones, the RanRans Ransomware, may be the work of a threat actor whose products go back as far as April, with the BlackRose Ransomware campaign. Both threats use similar brand-advertising strings, but, more significantly, also leverage the Hidden Tear's functionality for locking their victims' data.
As an evident work in progress, the RanRans Ransomware's current samples all crash when launched without encrypting any files. If updated to remove these startup glitches, the RanRans Ransomware could block content including Word documents, Adobe PDFs, JPG pictures, compressed archives, and other formats of commonly used media. Although the RanRans Ransomware doesn't try to encode the entire filename, it does append '.ranrans' extensions onto them, giving it a similarity in symptoms to the BlackRose Ransomware's old attacks.
Most versions of Hidden Tear create Notepad files for negotiating any initial demands with the victims. However, the RanRans Ransomware uses a pop-up method that delivers its requests through a Windows alert. While malware experts saw the RanRans Ransomware's threat actor attempting to use the usual method of Bitcoin payments in exchange for giving up a decryptor, the host sites for all decryption links have pulled the associated content. While the victim still may pay, doing so provides no access to the file-unlocking app.
Keeping the Lifespan of a Poisonous Flower Short
While one might think that a bug-riddled Trojan is less of a problem than a fully-working one, any file-encrypting Trojan, bugged or not, has significant capacity to endanger the files of an infected PC. In some cases, these coding errors even can prevent the recovery of your locked content by mishandling either the original encryption routine or the storage of the key for decoding. With the RanRans Ransomware's family of Hidden Tear, local backups and the Shadow Copies also may be deleted, closing off other routes for data restoration.
Save your backups to non-local cloud servers or detachable devices to remove all possibility of the RanRans Ransomware having access to your media. Since malware experts often see campaigns like the RanRans Ransomware's attacks using e-mail or website-based infection vectors, monitoring your browser security is also beneficial. When active, many anti-malware products can remove the RanRans Ransomware and all other members of the Hidden Tear family without any risk to the data on your PC.
Failing to analyze the risk and reward probabilities of potentially unsafe behavior online is responsible, not just for distributing threats like the RanRans Ransomware, but enabling their profits. Throwing money at a con artist, with no chance for refunds, all too often is nothing more than a way to get poorer in return for nothing.
Use SpyHunter to Detect and Remove PC Threats
If you are concerned that malware or PC threats similar to RanRans Ransomware may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.
Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.
File System Modifications
The following files were created in the system:
file.exeFile name: file.exe
Size: 219.13 KB (219136 bytes)
Detection count: 44
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: July 13, 2017