RanRans Ransomware

Posted: July 10, 2017
Threat Metric
Threat Level: 10/10
Infected PCs 5

RanRans Ransomware Description

The RanRans Ransomware is a Trojan that blocks you from opening media such as documents, pictures, or spreadsheets by encoding each file. It sells the data-unlocking feature for cryptocurrency payments, although malware experts advise against paying, especially since this threat's payload is buggy. Use backups or free decryption tools for unlocking any content that the Trojan damages, and delete the RanRans Ransomware with any standard anti-malware products.

A New Blossom from a Toxic Spring

While it does have competition, Hidden Tear is most likely still the most widely-abused resource for plundering to create minor variants of Trojans with encryption-based features turned towards extortion. One of the newer clones, the RanRans Ransomware, may be the work of a threat actor whose products go back as far as April, with the BlackRose Ransomware campaign. Both threats use similar brand-advertising strings, but, more significantly, also leverage the Hidden Tear's functionality for locking their victims' data.

As an evident work in progress, the RanRans Ransomware's current samples all crash when launched without encrypting any files. If updated to remove these startup glitches, the RanRans Ransomware could block content including Word documents, Adobe PDFs, JPG pictures, compressed archives, and other formats of commonly used media. Although the RanRans Ransomware doesn't try to encode the entire filename, it does append '.ranrans' extensions onto them, giving it a similarity in symptoms to the BlackRose Ransomware's old attacks.

Most versions of Hidden Tear create Notepad files for negotiating any initial demands with the victims. However, the RanRans Ransomware uses a pop-up method that delivers its requests through a Windows alert. While malware experts saw the RanRans Ransomware's threat actor attempting to use the usual method of Bitcoin payments in exchange for giving up a decryptor, the host sites for all decryption links have pulled the associated content. While the victim still may pay, doing so provides no access to the file-unlocking app.

Keeping the Lifespan of a Poisonous Flower Short

While one might think that a bug-riddled Trojan is less of a problem than a fully-working one, any file-encrypting Trojan, bugged or not, has significant capacity to endanger the files of an infected PC. In some cases, these coding errors even can prevent the recovery of your locked content by mishandling either the original encryption routine or the storage of the key for decoding. With the RanRans Ransomware's family of Hidden Tear, local backups and the Shadow Copies also may be deleted, closing off other routes for data restoration.

Save your backups to non-local cloud servers or detachable devices to remove all possibility of the RanRans Ransomware having access to your media. Since malware experts often see campaigns like the RanRans Ransomware's attacks using e-mail or website-based infection vectors, monitoring your browser security is also beneficial. When active, many anti-malware products can remove the RanRans Ransomware and all other members of the Hidden Tear family without any risk to the data on your PC.

Failing to analyze the risk and reward probabilities of potentially unsafe behavior online is responsible, not just for distributing threats like the RanRans Ransomware, but enabling their profits. Throwing money at a con artist, with no chance for refunds, all too often is nothing more than a way to get poorer in return for nothing.

Use SpyHunter to Detect and Remove PC Threats

If you are concerned that malware or PC threats similar to RanRans Ransomware may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.

Download SpyHunter's Malware Scanner

Note: SpyHunter's free version is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware tool to remove the malware threats. Learn more on SpyHunter. If you would like to uninstall SpyHunter for any reason, please follow these uninstall instructions. To learn more about our policies and practices, visit our EULA, Privacy Policy and Threat Assessment Criteria.

Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



file.exe File name: file.exe
Size: 219.13 KB (219136 bytes)
MD5: 7774a30be28a49f293bba343f3b3409c
Detection count: 44
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: July 13, 2017
Home Malware Programs Ransomware RanRans Ransomware

Leave a Reply

Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter. If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.