Remove LanRan v2 Ransomware – Restore .LanRan2.0.5 Files
THREAT REMOVAL

Remove LanRan v2 Ransomware – Restore .LanRan2.0.5 Files

OFFER

SCAN YOUR PC
with SpyHunter

Scan Your System for Malicious Files
Note! Your computer might be affected by LanRan v2 and other threats.
Threats such as LanRan v2 may be persistent on your system. They tend to re-appear if not fully deleted. A malware removal tool like SpyHunter will help you to remove malicious programs, saving you the time and the struggle of tracking down numerous malicious files.
SpyHunter’s scanner is free but the paid version is needed to remove the malware threats. Read SpyHunter’s EULA and Privacy Policy

LanRan ransomware desktop ransom message sensorstechforum

This article provides information about a ransomware dubbed LanRan v2 as well as descriptive steps how to remove its malicious files from the system. The threat encrypts important files and demands a ransom payment. By reaching the end of the article, you will know also which alternative data recovery methods may help you to restore a few to all of the .LanRan2.0.5 files.

New version of LanRan ransomware has been spotted in the wild. The analysis of its samples reveals that this time the threat uses the specific extension .LanRan2.0.5 to mark corrupted files. Like its predecessor, LanRan v2 plagues computer systems in order to locate target data and encrypt it with strong cipher algorithm. At the end of the attack, a ransom message that replaces the desktop wallpaper demands a ransom payment of 0.5 BTC for a decryption solution.

Threat Summary

NameLanRan v2
TypeRansomware, Cryptovirus
Short DescriptionA data locker ransomware that utilizes strong cihper algorithm to encrypt valuable files on stored on the infected computer and extorts a ransom payment from victims.
SymptomsImportant files are locked and marked with .LanRan2.0.5 extension. Ransom message demands a payment of 0.5 BTC for decryption solution.
Distribution MethodSpam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by LanRan v2

Download

Malware Removal Tool

User ExperienceJoin Our Forum to Discuss LanRan v2.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

LanRan v2 Ransomware – Distribution

An infection with LanRan v2 ransomware is triggered by a malicious executable file. In order to deliver this file to large number of computer devices hackers implement various methods. Email spam campaigns are considered to be the main technique used for ransomware distribution. Hackers often choose it because it allows them to reach large number of online users by obtaining email lists. Such lists could be released on underground hacker markets accessible through the dark web. As of the emails hackers send, they could impersonate representatives of well-known companies like PayPal, DHL, FedEx, and Amazon, or sometimes as governmental institutions. The purpose of these emails is to trick you into downloading compromised file attachment or visiting a corrupted web page. The moment you open the malicious file on your PC or visit the plagued web page you start LanRan v2 ransomware infection process.

If you want to keep your system secure be advised to check the security status of the files you download from across the net before you open them on your PC. You can do it with the help of a free online file extractor that will scan uploaded files for specific malicious traits. The information you will see after the scan could help you to avoid severe malware infections like Hyena Locker ransomware from infecting your system and data.

LanRan v2 Ransomware – Overview

LanRan ransomware was first spotted to harass online users in March 2017. A day ago security researchers detected new sample of the threat that is currently spreading in active attack campaigns. This iteration of LanRan ransomware is considered to be version two as suggested by the specific extension .LanRan2.0.5 associated with the threat.

Ransomware is a threat with a complex code that is not only set to corrupt valuable data but your whole system. Various obfuscation techniques may conceal the ransomware presence on the system and keep it invisible until it fulfils all malicious activities set in its code.

Some of the modifications implemented by LanRan v2 ransomware are likely to affect the certain registry keys stored in the Registry Editor. Among the most targeted ones are Run and RunOnce as they control the automatic execution of all essential processes each time the system is started as well as during its running time. By adding its values under these keys LanRan v2 becomes able to start its infection files on each system launch.

When LanRan v2 ransomaware virus finishes the infection process of the system and encrypts valuable data, it drops two files that contain specially crafted ransom messages. The files are of different types. The first one is a text file called @[email protected] and the message it presents reads:

L_A_N_R_A_N R_A_N_S_O_M_W_A_R_E

#################################################################################

Attention! Attention! Attention! Your files has been encrypted By L_A_N—R_A_N_S_O_M_W_A_R_E

#################################################################################

What is encryption?

Encryption is a reversible modification for security reasons but providing full access to it for
authorized users. To become an authorized user and keep the modification absolutely reversible (in
other words to have a possibility…

#################################################################################

But not only it

It is required also to have the special decryption software (in your L_A_N_R_A_N Decryption software)
for safe and complete decryption of all your files and data.

#################################################################################

Send 0.5 Bitcoin To @ 1sUCn6JYa7B96t4nZz*******CmS @

#################################################################################

for decrypt your files Contact us By Email: [email protected] If Send 0.5 Bitcoin We will send
you the decryption key LanRan Decryptor

#################################################################################

It’s Your Choice

With the help of specific scripts, the ransomware replaces the desktop wallpaper with the second file which depicts a ransom message as well. So in case that your PC is infected by LanRan your desktop probably displays the following image:

LanRan ransomware desktop ransom message sensorstechforum

The message depicted as an image reads:

Attention! Attention! Attention! Your files has been encrypted By L_A_N—R_A_N_S_O_M_W_A_R_E
But not only it
It is required also to have the special decryption software
(in your L_A_N_R_A_N Decryptor software) for sale and complete decryption of all your files and data
Send 0.5 Bitcoin To
1sUCn6JYa7B96t4nZz*******
for decrypt your files Contact us By Email: [email protected]
If Send 0.5 Bitcoin We will send you the decryption key LanRan Decryptor
It’s Your Choice

According to hackers’ instructions, you need to transfer the amount of 0.5 BTC (3,678 USD at the moment of writing this article) to their wallet and then write them at [email protected] for the decryption key. However, as reported by security researchers, there is no registered case of infected user who has received a decryption key even after a successful ransom payment. This means that even cyber criminals cannot decrypt the data. So don’t rush to pay the ransom as this won’t help you to recover your .LanRan2.0.5 files.

Hopefully, security specialists will soon crack the code of the threat and release free decryption solution the moment they succeed to do it. Meanwhile, you could try to recover part of the corrupted .LanRan2.0.5 files with the help of alternative data recovery methods. If you wonder which these methods are, just navigate to the end of the article where you will find suggestions for some of the most efficient ones.

LanRan v2 Ransomware – Encryption Process

When all needed system modifications are implemented, LanRan v2 activates its built-in encryption module to fulfil its primary purpose. Supposedly like its previous version, the ransomware uses the sophisticated RSA-2048 algorithm to transform the original code of target files. Files with the following extensions are most likely to be corrupted by LanRan v2 :

→.7z, .bmp, .doc, .docm, .docx, .html, .jpeg, .jpg, .mp3, .mp4, .pdf, .php, .ppt, .pptx, .rar, .rtf, .sql, .tiff, .txt, .xls, .xlsx, .zip

After encryption each corrupted file has the specific extension .LanRan2.0.5 appended to its name while the information it contains is inaccessible. Below you can see an example of file encrypted by LanRan v2 crypto virus:

file encrypted by LanRan ransomware .LanRan2.0.5 extension

Remove LanRan v2 Ransomware and Restore .LanRan2.0.5 Files

Below you could find how to remove LanRan v2 step by step. To remove the ransomware manually you need to have a bit of technical experience and ability to recognize traits of malware files. Beware that ransomware is a threat with highly complex code that plagues not only your files but your whole system. So as recommended by security researchers you need to utilize an advanced anti-malware tool for its complete removal. Such a tool will keep your system protected against devastating threats like LanRan v2 and other kinds of malware that endanger your online security.

After you remove the ransomware make sure to check the “Restore Files” step listed in the guide below. But before you take any further actions, don’t forget to back up all encrypted files to an external drive in order to prevent their irreversible loss.

Note! Your computer system may be affected by LanRan v2 and other threats.
Scan Your PC with SpyHunter
SpyHunter is a powerful malware removal tool designed to help users with in-depth system security analysis, detection and removal of threats such as LanRan v2.
Keep in mind, that SpyHunter’s scanner is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter’s malware removal tool to remove the malware threats. Read our SpyHunter 5 review. Click on the corresponding links to check SpyHunter’s EULA, Privacy Policy and Threat Assessment Criteria.

To remove LanRan v2 follow these steps:

1. Boot Your PC In Safe Mode to isolate and remove LanRan v2 files and objects
2. Find files created by LanRan v2 on your PC

Use SpyHunter to scan for malware and unwanted programs

3. Scan for malware and unwanted programs with SpyHunter Anti-Malware Tool
4. Try to Restore files encrypted by LanRan v2
Gergana Ivanova

Gergana Ivanova

Gergana has completed a bachelor degree in Marketing from the University of National and World Economy. She has been with the STF team for three years, researching malware and reporting on the latest infections. She believes that in times of constantly evolving dependency of network connected technologies, people should spread the word not the war.

More Posts

Follow Me:
Google Plus

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...