Geek's Advice

OOII ransomware takes computer files hostage by encrypting them

OOII ransomware is a malicious data-encrypting virus that is distributed by cybercriminals with the intention of extorting huge sums of ransom money from their victims. This newly emerged variant belongs to the infamous STOP/DJVU ransomware family. After encrypting files contained in any computer it infects, it will append .ooii extension to all of them respectively. For e.g., files that were hitherto saved as 1.jpg would be renamed as 1.jpg.ooii and so on. Also, the ransomware would drop _readme.txt in all the folders; these are ransom notes from those behind the ransomware attack informing the victim about the situation and the need for them to get in touch ASAP in order to pay ransom in exchange for OOII decryption tool.

They will elaborate that OOII ransomware virus by virtue of the encryption, has rendered useless all documents, pictures, data and every other important information contained in the compromised computer. Therefore, the only way they would hope to ever recover the files would be by paying ransom to the cybercriminals so they could provide decryption solutions. Also included in the messages are two email addresses, namely support@sysmail.ch and helprestoremanager@airmail.cc. which the cybercriminals would hope to communicate further with.

Decryption service prices, as well as terms of payment, would also be listed. For instance, they will state that the victim’s ransom amount depends on how fast they can meet up with payment. The default ransom fee is put at $980, but victims will be required to pay 50% or $490 within 72 hours/3 days of being notified, but once the grace period elapses, only the maximum ransom fee would be acceptable.

However, more conditions would be given to the victim if they decide to contact the cyber criminals through any of the emails. They will state that payment can be only made by purchasing cryptocurrency that is worth the ransom fee and transferring same to a wallet address they will provide. They obviously use this option in order to avert possible attempts by law enforcement agents to track them down using the payment link. To assure the victim of their expertise to decrypt the files, they often suggest that excerpts of the encrypted files should be sent to them for test decryption but will also warn that such excerpt shouldn’t contain information that could be perceived as important to the victim.

Our cybersecurity experts advise that victims should not pay ransom regardless of the pressure from cybercriminals and this view is similar to the FBI’s recommendation regarding ransomware incidents. The reasons why most reputable security agencies strongly advise against ransom payment are listed below:

• There is no guarantee of data recovery even after paying huge sums of money as ransom.
• Ransom payments encourage cybercriminals to continue in their nefarious activities since they would find it lucrative.
• More funds at their disposal helps them to employ more rogue IT experts and expand their operations.
• By law, it might be illegal to pay ransom (according to your country’s regulations).

Moreover, this virus often drops information-stealing Trojans such as AZORULT or VIDAR on infected hosts, and these can silently steal your software account login credentials, banking details, cryptocurrency wallets, browsing history, browser-saved passwords and more. This can lead to even more scams and potentially further blackmailing.

If you’ve fallen victim to a file-encrypting malware attack, we recommend you to remove OOII ransomware virus as quickly as possible. The best way to do that is to boot the infected computer using Safe Mode and Networking before running genuine antivirus software on it. You can find a guide on how to do it below. It is very important to make use of only genuine antivirus to ensure optimal results. If you’re not sure of what brand to use, then we recommend INTEGO Antivirus because it has top-notch malware detection rate and provides robust real-time protection. Also, it would be best if you considered downloading RESTORO to help restore virus-damaged Windows OS files.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Ransomware distribution techniques used by cybercriminals

The most prolific method used by cybercriminals in distributing STOP/DJVU ransomware variants, including OOII virus, is through malicious online torrents. The cybercriminals would load malware on pirated software copies and they become triggered when unsuspecting users download them to their PC. Based on that, it is risky to open so-called key generators or fake cracks on a PC. A good number of victims at different times have reported certain pirated software contents as being used in spreading malware. Some of the most common ones are listed below:

• Cubase;
• Adobe Photoshop;
• Tenorshare 4ukey;
• AutoCad;
• Opera browser;
• Corel Draw;
• VMware Workstation;
• Various AV software;
• Fifa 20;
• Adobe Illustrator;
• League of Legends;
• Internet Download Manager;
• KMSPico (illegal Windows activation tool).

Based on the explanations thus far, it can be deduced that going to online torrents platforms to download software is a dangerous habit and is not worth the trouble. Cybercriminals actually use them as bait in getting their victims. Moreover, downloading such pirated software contents is illegal and subject to criminal prosecution. Instead, it is a lot better to encourage genuine software content producers by patronizing them and paying the requisite fees attached. Remember that whatever amount you pay will be insignificant compared to what cybercriminals will demand as a ransom fee when you eventually become a victim. On top of that, you won’t be at risk of losing private data to cybercriminals.

Another method used by cybercriminals in distributing ransomware is by sending malicious email attachments. In this case, they often compose “real” looking emails that seem to be emanating from acquaintances or popular brands such as Amazon, eBay, UPS, DHL, etc. They will also make use of formats like XLS, PDF or DOCX, among similar others, simply because they allow JavaScript and macro functions that can be easily attached with payloads that would be triggered externally in other computers.

The problematic aspect is that trying to tell a genuine email apart from the fake malware carrying ones has become difficult in recent times. This is because cyber criminals now mirror their own emails to appear similar to genuine ones. They would also be accompanied with attachments that bear compelling tags such as Tracking details, Order Summary, Invoice or similar ones. They may even leverage email spoofing techniques to hide the actual sender’s email address to throw the recipient off balance.

Whatever gimmick they use, it is best to threat with caution. If an email is not being expected or something seems out of place about it, then it could as well be a red flag and shouldn’t be opened.

Lastly, those that have become victims of STOP/DJVU ransomware already should ignore certain suspicious websites that claim to offer decryption services. More often than not, such websites were established by cybercriminals hoping to exploit victims who are desperate to find solutions. Their motive is to further spread other variants of ransomware. At the moment, only Emsisoft and DiskTuna have proven to offer decryption solutions that actually work.

Further details about the virus

For those that are wondering about the extent of damage that could have been done on their computer during OOII ransomware attack, this section will explain in detail the technical aspect of what happened. The first thing the virus does following an infiltration is to set up build.exe and build2.exe executables as well as winupdate.exe (the prompt that brings up fake Windows update screen). It then connects to https[:]//api.2ip.ua/geo.json before saving the result in the geo.json file. Afterward, it will commence information gathering of every detail concerning the computer, such as the computer’s time zone, geolocation, zip code, longitude and latitude, and would save it in its geolocation-related database. A screenshot of geo.json file is shown below.

It will equally create another file that would contain hardware details, installed software list, active processes and would be stored in information.txt.

Making use of the computer’s geolocation detail, the malware will profile it against a list of countries the cybercriminals designated as encryption exempted, namely: Russia, Syria, Armenia, Tajikistan, Ukraine, Kazachstan, Kyrgyzstan, Uzbekistan and Belarus. If peradventure the malware detects that the computer about to be compromised is domiciled in any of the listed countries, it will instantly close its processes.

However, if that’s not the case, the ransomware would then extract online encryption key from their central database and would combine it with the victim’s ID before saving them in the bowsakkdestx.txt file and to the PersonalID.txt file. Displayed below are examples of these files.

If for any reason it fails to extract an online encryption key from their server, the ransomware will resort to the use of a hardcoded offline key as an alternative. The offline key is a one-size-fits-all in the sense that it is uniform for every victim of the same virus variant. The appearance of t1 characters at the end of a victim’s ID is an indication that an offline key was used and it offers a higher chance of decrypting .ooii files someday. You can check the details below for more information about this.

At this stage, the ransomware will commence the full data encryption process by scanning every folder while encrypting all files with Salsa20 before locking the encryption key using the RSA-2048 key. While this process is still ongoing, it will also mark the files with .ooii extension.

Displayed in the screenshot below is _readme.txt ransom note that is usually dropped in each folder.

Afterward, the virus will delete the Volume Shadow Copies using the command prompt as shown here:

^{vssadmin.exe Delete Shadows /All /Quiet}

Before completing the attack, the malware will blacklist certain domains by adding them Windows HOSTS file and also mapping them to the localhost IP. This would effectively prevent the victim from getting any form of help that may be offered in those sites and instead would encounter DNS_PROBE_FINISHED_NXDOMAIN error messages each time they try.

Remove OOII Ransomware Virus and Restore Your Files

Like we always advise, the first thing that should be done once it is ascertained that a PC has been compromised during a ransomware attack is to remove OOII ransomware virus ASAP by making use of ONLY GENUINE antivirus software while the PC is set up on Safe Mode with Networking. This is highly recommended because it will enable the virus removal process to be effective and efficient.

If you’re not sure of any antivirus that would be good enough, then you should go for INTEGO Antivirus because in our opinion, it’s one of the best antivirus software available in the market. As an additional step following a OOII ransomware removal, we recommend you to download this tool – RESTORO and scan your computer to identify virus-damaged Windows OS files and repair them (using full version).

Once the virus is removed, the following steps should be taken:

• Report to local authorities that handle such issues.
• Make use of any backup device to restore lost files.
• Learn possible ways STOP/DJVU-infected files could be decrypted.
• Change all passwords associated with the compromised computer without further delay.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.