Rokku Ransomware

Although some computer infections raise questions regarding their maliciousness, there is no doubt that Rokku Ransomware is malicious. This devious infection does not try to represent itself as something it is not, and it does not hide itself. Of course, it uses deception to slither into your operating system to make sure that it can initiate malicious processes without your notice; however, it does not conceal its true intentions after that. Most ransomware infections usually travel via spam email attachments, and it would not be surprising if you have unleashed this threat after downloading and opening a legitimate-looking document, PDF file, photo, or something like that sent to you by cyber criminals in disguise. The problem is that this infection can be executed without you even noticing it, after which it proceeds to perform file encryption. If you are lucky, you will remove Rokku Ransomware before it encrypts your files; however, our experience shows that this infection is almost always successful.

The name of Rokku Ransomware derives from an extension (.rokku) that is attached to the files encrypted by this threat. You are allowed to change the extension, remove the unwanted attachment, but that does not change the fact that your file is encrypted. According to our research, RSA-3072 algorithm is used for the encryption of your files. In this method, a public key is used to encrypt files, and a private key is used to decrypt them. The creators of this ransomware keep this decryption key safe so that you could not access it and decrypt your personal files for free. Of course, cyber criminals do not just encrypt your files for fun. They use this malicious attack to coerce you into giving up your money. The tests conducted in our internal lab have shown Rokku Ransomware demanding 0.2408 BTC, which is around 100 USD; however, it is possible that the ransom demanded from you will be different.

Once installed, Rokku Ransomware will encrypt your files and will create files (TXT and HTML) with the instructions that you are asked to follow. README_HOW_TO_UNLOCK.TXT is one of these files, and it orders users to download the Tor browser, visit a provided website (zvnvp2rhe3ljwf2m.onion), and follow further instructions. Here, you are asked to submit your Order ID and proceed with the payment. Because users are asked to pay the ransom in Bitcoins, which is a virtual currency, they are provided with steps that involve setting up a Bitcoin Wallet and paying the provided ransom. Once you pay the ransom, a decryption tool is provided to you, and you need to download it to initiate the decryption process. It was found by our malware analysts that this tool works. Of course, this does not mean that we recommend following the demands of cyber criminals because the money they receive can be used to fund other scams.

Unfortunately, Rokku Ransomware encrypts personal files (e.g., .jpg, .doc, .pdf, etc.), which is why many computer users choose to follow the demands and pay the ransom. You have to inspect the files corrupted by this threat and see if they are actually worth the money. Are you sure you want to pay money for old Word documents? Obviously, you are more likely to be attached to photos and other personal files. Luckily, most users nowadays back up their files using external drives or using online systems, in which case, the files encrypted by Rokku Ransomware are not lost for good. If your files are backed up as well, you need to delete this ransomware without any hesitation. Now, if you find that you need to pay the ransom, you need to make sure that you eliminate the infection as soon as your files are decrypted successfully.

The removal of Rokku Ransomware is not complicated. This infection does not need to rely on multiple components to evade removal because its main task is to encrypt your files which it can do using one single file. In fact, some ransomware threats even delete themselves right after execution. The only complicated step in the instructions below might be the detection of the malicious file that has been used for the execution of this threat. In our case, it was an MS OFFice Word files with a random name. If you are having trouble detecting and eliminating malicious files, please install an anti-malware tool that could erase all dangerous files and all infections automatically.

Rokku Ransomware Removal

1. Find the malicious executable (e.g., a MS OFFice Word file with a random name) and Delete it.
2. Launch Explorer (simultaneously tap Win+E).
3. Enter %ALLUSERSPROFILE%\Windows (%ALLUSERSPROFILE%\Application Data\Windows) into the address bar.
4. Delete the file called "csrss.exe".