Oohu Ransomware Scrambles Your Files

While examining malware samples, we came across a ransomware variant called Oohu. Oohu is designed to encrypt files and change their file names by appending the ".oohu" extension. Additionally, Oohu generates a ransom message called "_readme.txt."

To illustrate Oohu's file name modifications, it transforms files like "1.jpg" into "1.jpg.oohu" and "2.png" into "2.png.oohu," and so forth. It's important to note that Oohu is a member of the Djvu ransomware family. Often, cybercriminals deploy Djvu ransomware in conjunction with data-stealing malware like RedLine or Vidar.

Within the ransom note, the cybercriminals provide instructions and contact email addresses (support@freshmail.top and datarestorehelp@airmail.cc). They advise victims to get in touch within 72 hours to prevent an increase in the ransom amount. Initially, the decryption fee is set at $490, but failing to respond within the specified timeframe results in an increase to $980.

Furthermore, the note emphasizes that the victim cannot recover the encrypted files without obtaining the decryption software and a unique key from the cybercriminals responsible for the cyberattack.

Oohu Ransom Note Demands $490 in Ransom Payment

The full text of the Oohu ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-XA1LckrLRP
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can You Protect Your Data from Ransomware Attacks?

Protecting your data from ransomware attacks is essential to safeguard your personal and business information. Here are several steps you can take to enhance your data's security and reduce the risk of falling victim to ransomware:

Regularly Backup Your Data:
Implement automated backup solutions for your important files and systems.
Store backups offline or in a separate network segment to prevent them from being compromised in an attack.

Keep Software Up to Date:
Regularly update your operating system, software, and applications to patch known vulnerabilities that ransomware can exploit.

Use Strong, Unique Passwords:
Utilize complex passwords or passphrase combinations.
Implement a password manager to securely store and manage your passwords.

Enable Two-Factor Authentication (2FA):
Whenever possible, enable 2FA for your online accounts and services.

Install Reliable Security Software:
Employ reputable antivirus and anti-malware solutions.
Consider using ransomware-specific protection tools.

Implement Email Filtering:
Use email filtering tools to block suspicious attachments or links.