A new ransomware is on the loose, and it can enter your computer secretly and encrypt all of your valuable files. It is called Okeanfirstname.lastname@example.org Ransomware, and it is being disseminated using email spam disguised as legitimate emails. If you do not remove such an email but open the file attached to it, then your computer will become infected with this ransomware. This malware is all about extorting money from you. It offers to purchase the decryption program needed to get your files back, but there is no telling whether you will get it or if the program will work at all even if you receive it.
Okeanemail@example.com Ransomware is similar to Alex.firstname.lastname@example.org Ransomware, Redshitline Ransomware, Troldesh Ransomware and a few other infections. It might not come from the same developers, but the file structure of all of these malicious applications is quite similar. Like its counterparts, this ransomware is being disseminated via email spam so your computer can become infected with it when you open a file attachment that comes in the fake email. The attachment may look like a PDF or Word file, but it is fake and will drop this ransomware's malicious executable onto your computer. The only way you can stop this infection is if you have an antimalware program on your PC. However, once Okeanemail@example.com Ransomware is on your computer, you cannot do anything about it, and it will encrypt most of your files.
Our research has revealed that it uses the RSA-2048 encryption algorithm which is a strong encryption method. This ransomware generates a unique key for each user, so third-party decryptors cannot decrypt your files. Note that while encrypting, this ransomware will append the files with a custom file extension that will look similar to firstname.lastname@example.org.!dsvgdfvdDVGR3SsdvfEF75sddf#xbkNY45.xtbl. Take note that !dsvgdfvdDVGR3SsdvfEF75sddf#xbkNY45.xtbl is the unique user ID, so it varies with each case. Once the encryption is complete, the ransomware will generate a file named How to restore files.hta that is dropped in each folder where a file was encrypted and five unrelated directories (see the removal guide for more information.) Furthermore, Okeanemail@example.com Ransomware’s main executable will automatically delete itself when everything is in place.
The ransom note states what we already know — that the files have been encrypted. The ransom note warns you not to use third-party decryption software since they are not compatible with the unique encryption keys that this ransomware generates from each user. Moreover, it says that you have 24 hours to pay the ransom, or the decryption will become difficult. We do not know what this means because it appears that it was created by Russian-speaking developers that poorly translated the ransom note into English.
Now, there are some other things that take place in the background when this ransomware infects your computer. It creates an executable named trust.exe, but its name can be different and vary with each infection. This ransomware creates three copies of this file and places them in C:\Users\user\AppData\Local, %UserProfile%\Local Settings\Application Data, %LOCALAPPDATA%. Also, it will create more copies of How to restore files.hta and place them in five folders in total and create one registry string at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce.
Unfortunately, a decryption program that could decrypt the files encrypted by this ransomware has yet to be developed. However, we urge you to refrain from paying the ransom because you might not get the promised decryptor. Also, there is no telling how much money the criminals will demand that you pay for that decryptor. So we recommend that you remove Okeanfirstname.lastname@example.org Ransomware. Now, there are two ways you can get rid of it. You can either remove all of the files manually or get an antimalware application such as SpyHunter to do this for you. Keep in mind that the main executable deletes itself automatically so the remaining files will not encrypt newly added files.