RanRan is a ransomware that was discovered on May 5, 2017. This ransomware is being distributed by email phishing campaigns. The emails used in these campaigns pretend to be from well-known companies or organizations, and they often contain attachments that claim to be invoices, receipts, or other important documents. When opened, these attachments will download and install RanRan onto the victim’s computer. Once installed, RanRan will encrypt the victim’s files using AES encryption and append the “.ranran” extension to the encrypted files. For example, a file named “1.jpg” would be renamed to “1.jpg.ranran”. Ransomware will then display a ransom note that contains instructions on how to pay the ransom and decrypt the encrypted files. This ransomware is currently being distributed in South Korea, but it will likely spread to other countries as well.
This ransomware will encrypt a variety of files on your computer, including documents, images, videos, and more. It is important to note that it will not encrypt every file on your computer. Instead, it will focus on specific file types that are considered the most valuable. The specific file types that RanRan targets are: .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pdf, .jpg, and .png.
The ransom amount for RanRan is currently unknown. However, the amount will likely be based on how much money the victim can afford to pay. The ransom note for RanRan instructs victims to contact the attackers via email to negotiate a ransom price. The payment method that RanRan uses is currently unknown, but the attackers will likely accept Bitcoin or another cryptocurrency.
Paying the ransom is never a guarantee that you will get your files back. There have been many cases where victims have paid the ransom but did not receive the decryption key. If you decide to pay the ransom, we recommend that you only do so as a last resort.
There are a few prevention tips that you can use to help protect your computer from this threat:
If RanRan is already on your computer, it is important to remove it immediately. RanRan Ransomware is a serious threat that can result in the loss of your personal files. Additionally, this ransomware may also collect information from your computer, such as your IP address, email addresses, and passwords. This information could be used to commit identity theft or other crimes.
Removal methods
There are two main RanRan Ransomware removal methods: manual and automatic.
Manual RanRan Ransomware removal requires advanced computer skills. This method involves manually editing the Windows Registry and deleting RanRan Ransomware files. If you do not have advanced computer skills, we do not recommend using this method.
Automatic RanRan Ransomware removal is the recommended method for removing it. This method uses an anti-malware program to scan your computer for RanRan and other ransomware. Once it has found RanRan, it will remove it from your computer and protect it from future infections.
When RanRan has been removed from your computer, you can then attempt to decrypt your files using one of the methods below:
Method 1: Use file recovery software
If you have a backup of your files, you can restore them from the backup. This is the best option as it will allow you to recover your files without having to pay the ransom.
There are a few different file recovery programs that you can use, but we recommend SalvageData. This program can recover data from a variety of storage devices, including hard drives, SSDs, USB drives, and more.
Method 2: Use a RanRan decryptor
Unfortunately, there is no public RanRan decryptor available at this time.
Method 3: Use shadow copies
Windows automatically creates shadow copies of your files so that you can restore them in case they are lost or corrupted. RanRan will delete the shadow copies of your files, but you may be able to restore them using a program like ShadowExplorer. Simply download and install ShadowExplorer, then run it and select the RanRan encrypted files. ShadowExplorer will then attempt to restore the selected files from the shadow copies.
If you are not comfortable attempting to remove RanRan or decrypt your files yourself, so let it to the professionals – contact a data recovery service. These services specialize in ransomware removal and data recovery.
There are a few things to keep in mind if you decide to use a data recovery service:
If you decide to use a data recovery service, SalvageData Recovery Services is the best option. SalvageData has a great reputation and offers a free consultation to help you determine the best course of action for your RanRan encrypted files.
Our company has been in business for over 10 years and has a team of highly trained experts. We offer a free consultation to assess the damage and estimate the cost of recovery.
We also have a no recovery, no-fee policy, so you only pay if we are able to successfully recover your data.
To get started, simply fill out our online form or give us a call at 1-888-872-3282. We will help you get your life back to normal.
Recovery mode is a crucial feature for troubleshooting and restoring an iPad when it encounters…
Whether you’re a professional juggling important work documents or an individual cherishing irreplaceable memories, safeguarding…
It's not uncommon to encounter issues where an external drive is not showing up on…
When restoring your iPhone from a backup, you may discover it is corrupted or incomplete.…
Backup and remote wiping procedures are two critical components of data security and management for…
VMware is a leading virtualization and cloud computing software provider. Its core technology allows multiple…