Oni Ransomware

If your operating system is not protected in a reliable manner, all kinds of threats might invade it. In this report, we focus on Oni Ransomware, a malicious threat that appears to be targeted at users who live in Japan. This malicious threat might be new to you, but, in fact, one of its variants is just a newer version of Globeimposter Ransomware, a threat that has evolved many times since its first emergence. If this malicious threat has invaded your operating system, it is most likely that your files are encrypted. What does that mean? That means that the data within your files is encoded, and only a special private key can be used for the decryption. This key is unique in every case, and deciphering it is impossible, which is why decrypting files corrupted by this ransomware manually is impossible. Free file decryptors exist, but they cannot stand up to the cryptography used by cyber criminals. The worst part is that deleting this malware is not something you can handle easily either. Please continue reading to learn what needs to be done to have Oni Ransomware removed.

It is easy to identify the malicious Oni Ransomware by the extension it adds and the ransom note it presents. The extension is “.Oni”, and you are likely to find it attached to every personal file that exists on your PC. The ransom note is represented via a file named “!!!README!!!.html”. This note informs that すべてのファイルは、RSA-2048およびAES-256暗号で暗号化されています, which means that RSA and AES encryption keys are both used in the encryption process. The ransom note lets us know that files can be restored – which is a lie – if you email hyakunoonigayoru@yahoo.co.jp. If you did that, it is most likely that cyber criminals would demand a ransom from you. That is one version of the malicious Oni Ransomware, and this one seems to be targeted at regular Windows users. The second version of this malware is also known as the ONI MBR Ransomware, and this one is similar to Badrabit Ransomware and NotPetya Ransomware, both of which can encrypt the Master Boot Record (MBR). This version of the threat should show a password-protected screen before the boot of the system.

According to the latest research by malware analysts, Oni Ransomware is spread using a remote administration Trojan (RAT) called “Ammyy.” The RAT is spread using a spam email with a .zip archive attachment. Inside the archive, a malicious document file is found. When the file is opened and the macros is enabled, a VBS script is launched to install the RAT. Malware experts at cybereason.com suggest that the devious Oni Ransomware is used as a wiper – in those cases where it encrypts the MBR – to conceal malicious activity previously conducted on the systems of big Japanese companies. The research company has found cyber criminals linked to Oni Ransomware to delete Windows event and security logs as well, which supports the theory. The ONI MBR version of the malicious threat is not widely spread. In fact, only a few systems have been found to be affected by this malware. The same goes with the threat based on the infamous Globeimposter Ransomware, which, most likely, was created to serve in the same way that other file-encryptors do, which is to coerce victims into transferring money.

So, what about the removal? Since Oni Ransomware most likely is downloaded and executed with the help of a remote administration Trojan, manual removal is not recommended. Even if you are experienced, eliminating the malware that exists on your operating system can be excruciatingly difficult. The solution we propose is installing up-to-date, legitimate anti-malware software that is equipped to deal with all kinds of threats. The right tool will automatically delete Oni Ransomware along with Trojans and other malicious infections that might have invaded your operating system without your permission. When it comes to personal data, you will not recover it regardless of whether you are dealing with the regular version or the MBR-encrypting one. Let this be a lesson that keeping the operating system protected is crucial. You can aid anti-malware software by keeping away from spam emails, malicious downloaders, unreliable links, and other security backdoors. Also, back up files to ensure that they are safe at all times.