Ranion Ransomware Virus (Removal Steps and Protection Updates)

Computer security experts alarmed of a dangerous new threat known as Ranion Ransomware, read our removal guide to learn more about it. It will also give you information on how to protect yourself in the future.

Ranion Ransomware Description

The Ranion Ransomware is a dangerous new malware threat which is marketed as a Ransomware-as-a-service otherwise known as a RaaS.

This is an advanced virus that can be further modified by various hackers and adapted to their predefined targets. This means that almost everything can be changed in the virus engine – from the file type extension to the additional payload infection modules. As such we expect to see many strains of the virus if it proves to have a strong base encryption engine.

The malware researchers who reported the infections have gained access to the Ranion ransomware TOR page which gives further details about it:

RANION – The Better & Cheapest FUD Ransomware + C&C on Darknet
BUY – FAQ – CONTACT
We provide an already configured and compiled FUD Ransomware + Decrypter
We are the only that provide a FREE Anonymous C&C Dashboard via Onion to manage your Clients
We also provide additional FREE Customizations and DON’T take Fees from your Clients
DISCLAIMER: Our Products are for EDUCATIONAL PURPOSES ONLY.
Don’t use them for illegal activities. You are the only responsable for your actions!
Our Products/Services are sold with NO WARRANTY and AS ARE.
*** ranionjgot5cud3p.onion ***
…
-= CHOOSE YOUR PACKAGE =-
[PACKAGE #1] – 1 YEAR C&C Dashboard (RaaS) – Price: 0.95 btc
FUD Ransomware (AES 256 Encryption with a 30 chars long uncrackable key)
Decrypter
1 Year C&C Dashboard (to receive the AES keys from Clients)
We take NO FEES from your Clients
Optional: additional Crypter adding 0.1 btc
Optional: additional file types to encrypt for free (for all file types encrypted see FAQ)
Optional: additional client banner in your language for free (already present eng, rus, ger, fra, esp, ita)
[PACKAGE #2] – 6 MONTHS C&C Dashboard (RaaS) – Price: 0.60 btc
FUD Ransomware (AES 256 Encryption with a 30 chars long uncrackable key)
Decrypter
6 Months C&C Dashboard (to receive the AES keys from Clients)
We take NO FEES from your Clients
Optional: additional Crypter adding 0.1 btc
Optional: additional file types to encrypt for free (for all file types encrypted see FAQ)
Optional: additional client banner in your language for free (already present eng, rus, ger, fra, esp, ita)
-= HOW TO BUY =-
Send the Package’s price to following Bitcoin address: 1Lr9k7***
Write us an email to ranion(at)sigaint.org telling us:
– Chosen package
– Your Bitcoin address used to send us money
– Your own Bitcoin address to receive money from your Clients
– Your price to receive from your Clients (ie. 0.20 btc)
– Your email address to get contacted from your Clients
– Optional additions
Wait until we check your payment
You will receive an email with 2 links:
– The first one with your files (Ransomware + Decrypter)
– The second one with your dashboard
Your satisfaction is important! Contact us for any need.
Copyright (c) 2016-2017 – Ranion (RaaS)

From the provided information we see that the virus developers have created several packages. They are sold on the underground hacker markets and the available sets are the following:

Package #1

This includes a 1-year access to the ransomware servers for the price of 0.95 Bitcoins. In additions the encryption module is bundled with the AES-256 cipher which uses a 30-characters long key.
The decrypter is also supplied. Optional modules include additional cryptography modules, limited file type decryptions and custom client banners.

Package #2
Six months of C&C servers access for 0.60 Bitcoins. The other components are the same as in Package #1.

The FAQ section gives a detailed overview of the ransomware’s features. The criminal operators of the virus state that they have been active for more than 10 years in the hacker communities.

The ransomware’s infection behavior is the following:

1. The encryption engine is started and it encrypts all file types of the predefined list. The virus searches all connected hard drives.
2. The generated AES-256 private decryption key is sent to the C&C remote servers.
3. The ransomware note is crafted and shown to the user. In addition a banner message displaying the contents is shown to the user at computer boot.

By default these file types are encrypted by the virus:

“.txt”, “.rtf”, “.doc”, “.docx”, “.xls”, “.xlsx”, “.ppt”, “.pptx”, “.odt”, “.ods”, “.jpg”, “.jpeg”, “.png”, “.bmp”, “.csv”, “.sql”,
“.mdb”, “.db”, “.accdb”, “.sln”, “.php”, “.jsp”, “.asp”, “.aspx”, “.html”, “.htm”, “.xml”, “.psd”, “.cs”, “.java”, “.cpp”, “.cc”,
“.cxx”, “.zip”, “.pst”, “.ost”, “.pab”, “.oab”, “.msg”

Ranion Ransomware Distribution

The Ranion ransomware at the moment is distributed on various hacker underground markets available on the TOR anonymous netowrk. We pressume that future infections will probably be carried out by using various methods such as exploit kit intrusion attempts, spam email messages, browser hijackers, malicious ads and etc.

Ranion Ransomware – How To Remove it and Prevent It From Coming Back

There are two ways of removal:

• With an anti-malware tool – this will also help prevention
  
• Manually – using the instructions below

Ranion Ransomware Ransomware Removal

For a faster solution, you can run a scan with an advanced malware removal tool and delete Ranion Ransomware completely with a few mouse clicks.

STEP I: Start the PC in Safe Mode with Network
This will isolate all files and objects created by the ransomware so they will be removed efficiently.

1) Hit WIN Key + R

2) A Run window will appear. In it, write “msconfig” and then press Enter
3) A Configuration box shall appear. In it Choose the tab named “Boot”
4) Mark “Safe Boot” option and then go to “Network” under it to tick it too
5) Apply -> OK

Or check our video guide – “How to start PC in Safe Mode with Networking”

STEP II: Show Hidden Files

1) Open My Computer/This PC
2) Windows 7
– Click on “Organize” button
– Select “Folder and search options”
– Select the “View” tab
– Go under “Hidden files and folders” and mark “Show hidden files and folders” option

3) Windows 8/ 10

– Open “View” tab
– Mark “Hidden items” option



4) Click “Apply” and then “OK” button

STEP III: Enter Windows Task Manager and Stop Malicious Processes

1) Hit the following key combination: CTRL+SHIFT+ESC
2) Get over to “Processes”
3) When you find suspicious process right click on it and select “Open File Location”
4) Go back to Task Manager and end the malicious process. Right click on it again and choose “End Process”
5) Next you should go folder where the malicious file is located and delete it

STEP IV: Remove Completely Ranion Ransomware Ransomware Using SpyHunter Anti-Malware Tool

SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter

STEP V: Repair Windows Registry

1) Again type simultaneously the Windows Button + R key combination
2) In the box, write “regedit”(without the inverted commas) and hit Enter
3) Type the CTRL+F and then write the malicious name in the search type field to locate the malicious executable
4) In case you have discovered registry keys and values related to the name, you should delete them, but be careful not to delete legitimate keys

Further help for Windows Registry repair

STEP VI: Recover Encrypted Files

1) Use present backups
2) Restore your personal files using File History
– Hit WIN Key
– Type “restore your files” in the search box
– Select “Restore your files with File History”
– Choose a folder or type the name of the file in the search bar



– Hit the “Restore” button

3) Using System Restore Point

– Hit WIN Key
– Select “Open System Restore” and follow the steps

STEP VII: Preventive Security Measures

1) Enable and properly configure your Firewall.
2) Install and maintain reliable anti-malware software.
3) Secure your web browser.
4) Check regularly for available software updates and apply them.
5) Disable macros in Office documents.
6) Use strong passwords.
7) Don’t open attachments or click on links unless you’re certain they’re safe.
8) Backup regularly your data.

SpyHunter anti-malware tool will diagnose all current threats on the computer. By purchasing the full version, you will be able to remove all malware threats instantly. Additional information about SpyHunter / Help to uninstall SpyHunter