A ransomware that uses one of the most often used ransom messages, encrypting files with a strong cipher has been the reason for several reports of affected victims. The ODCODC ransomware (also known as crypto-virus) sets the .odcodc file extension to the newly encrypted files and leaves a “readthis.txt” ransom note. Users who have been infected with the ODCODC ransomware are advised to remove this ransomware immediately and try one of the file restoration methods illustrated after this article.
|Short Description||The ransomware may encrypt files with the RSA-2048 cipher and asks a ransom payment for decryption.|
|Symptoms||Files are encrypted and become inaccessible. A ransom note with instructions for paying the ransom shows as a readthis.txt file.|
|Distribution Method||Spam Emails, Email Attachments, File Sharing Networks.|
|Detection Tool|| See If Your System Has Been Affected by ODCODC |
Malware Removal Tool
|User Experience||Join our forum to Discuss ODCODC Ransomware.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
ODCODC Ransomware – How Is It Distributed
In order to be widespread, ODCODC Ransomware may use several different techniques to be spread out, but the main possibilities are:
Such may be spread in various ways, varying from malicious e-mail attachments to malicious URLs shared on various suspicious websites.
ODCODC Ransomware In Detail
Once activated on the computer, ODCODC ransomware may drop its payload files in one of the several folders:
- %User’s Profile Folder%
The files may be more than one and may be of the following file formats:
→ .dll, .txt, .exe, .tmp, .vbs, .bat, .cmd
They may contain random names or names that resemble a Windows process, for example, “svchost.exe”. The .tmp files are usually dropped in the %Temp% folder.
After the malicious files have been dropped, the ODCODC ransomware may employ a powerful RSA or AES encryption to files with the following extensions:
After encrypting the files of affected users, ODCODC ransomware may delete the shadow volume copies of the infected computer, eradicating any possibility of files being recovered from backups. This can happen by executing a .vbs script with the following administrative command:
After this is done, the ransomware may create a “readthis.txt” file with the following ransom message:
→ “Your personal files are encrypted!
What happened to your files?
All of your files were protected by a strong encryption with RSA-2048. https://en.wikipedia.org/wiki/RSA_(cryptosystem)
What does this mean?
This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you cant restore them.
What to do?
We can recover your files. You can trust us, for proof of this we can decrypt some your files for free.
How to contact you?
Write us to email: [email protected]
Ваши персональные файлы зашифрованы!
Что случилось с файлами?
Все ваши файлы зашищены криптостойким алгоритмом RSA-2048. https://en.wikipedia.org/wiki/RSA_(cryptosystem)
Что это значит?
Это значит, что структура и содержимое ваших файлов потерпили необратиме изменения, вы не можете с ними работать, читать или видеть, это тоже самое, что потерять их бесповоротно, но, с нашей помощью, вы можете их все восстановить.
Что мне делать?
Мы можем полностью восстановить доступ к вашим файлам. Вы можете нам доверять, доказать честность и серьезность наших намерений мы можем бесплатной расшифровкой нескольких файлов.
Как с вами связаться?
Напишите нам на почту: [email protected]”Source:Affected Users
ODCODC Ransomware – Conclusion, Removal, and File Restoring
The bottom line for this variant of crypto-malware is that it may be part of the Rakhni or Troldesh variants. Judging by the badly written ransom note in Russian, it has been created for Russian users, but it may not originate from Russia. Such files may be decrypted via Rakhni decryptor by Kaspersky, which we have posted along with other file restoration methods in step “3. Restore files encrypted by ODCODC” below.
However, if you want to try and restore your files, we advise you to either do it on a safe computer or follow the removal instructions below to remove the malware from your PC. They are methodologically arranged to help detect and remove ODCODC ransomware effectively.
Finally, we advise you to follow this article for further updates on ODCODC ransomware and in the meantime to try the methods from step “3” below to attempt and restore your files. They may not be 100 percent successful, but there is a possibility that you might be able to revert at least some of your files.