Oopl Ransomware Encrypts Victim Files

While analyzing malware samples, we encountered a type of ransomware called Oopl. This particular ransomware is designed to encrypt files and modify their file names by adding the ".oopl" extension to them. Additionally, Oopl creates a ransom note named "_readme.txt."

To illustrate how Oopl changes file names, it transforms files like "1.jpg" into "1.jpg.oopl" and "2.png" into "2.png.oopl," and so on. It's essential to note that Oopl belongs to the Djvu ransomware family. Frequently, cybercriminals distribute Djvu ransomware alongside other malware like RedLine or Vidar, which steal information.

Inside the ransom note, cybercriminals offer instructions and contact email addresses (support@freshmail.top and datarestorehelp@airmail.cc). They advise victims to get in touch within 72 hours to avoid an increase in the ransom amount. Initially, the decryption cost is set at $490, but failing to respond within the specified timeframe leads to an increase to $980.

Furthermore, the note underscores that recovering the encrypted files is considered impossible without obtaining the decryption software and a unique key from the cybercriminals responsible for the attack.

Oopl Ransom Note Demands $490

The full text of the Oopl ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-XA1LckrLRP
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can Ransomware Like Oopl Infect Your System?

Ransomware, including threats like Oopl, can infect your system through various methods and vulnerabilities. Here are some common ways ransomware can infiltrate a computer or network:

• Malicious Email Attachments: Cybercriminals often distribute ransomware via phishing emails. These emails may contain attachments, such as infected documents (e.g., Word or PDF files) or executable files (e.g., .exe). When the recipient opens the attachment, the ransomware is executed, infecting the system.
• Malicious Links: Phishing emails may also contain links to malicious websites or downloads. Clicking on these links can lead to the download and execution of ransomware on the victim's device.
• Exploiting Software Vulnerabilities: Ransomware authors exploit vulnerabilities in software, operating systems, or third-party applications. If a system is not regularly updated with security patches, it becomes susceptible to such attacks.
• Drive-By Downloads: Visiting compromised or malicious websites can result in drive-by downloads. In this scenario, the ransomware is automatically downloaded and executed without the user's consent or knowledge.
• Malicious Advertisements (Malvertising): Attackers may use malicious ads on legitimate websites to distribute ransomware. Clicking on these ads can trigger the download and installation of the malware.
• Remote Desktop Protocol (RDP) Attacks: If RDP is enabled on a computer or server with weak or easily guessed credentials, attackers can gain unauthorized access and deploy ransomware.
• Software Downloads from Untrusted Sources: Downloading software or files from unverified or shady sources increases the risk of downloading ransomware unknowingly.
• Infected External Devices: Ransomware can spread through infected USB drives, external hard disks, or other removable media. Plugging an infected device into a clean computer can lead to the malware's spread.
• Social Engineering: Attackers may use social engineering tactics to trick users into running malicious scripts or granting elevated privileges to the ransomware.