WannaRen ransomware: what it is and how to remove it

From our report of Apr 2020 · not reviewed since

More from our earlier report on WannaRen ransomware

• The pop-up window named WannaRen appears on the screen with a ransom message and additional pictures, the form where you can buy Bitcoins and transfer them to an included wallet address
• WannaRen ransomware removal requires attention from you and professional anti-malware tools that can detect this malware and remove all the programs associated with the infection
• You need to fully repair Windows system files and affected folders, settings.
• Get to do so and repair virus damage before you even consider data recovery options, so you can avoid losing those files

From our report of Apr 2020 · not reviewed since

WannaRen is the cryptovirus that resembles WannaCry virus and encrypts almost all files found on the targeted Windows system

WannaRen is the ransomware from hackers that is using .WannaRen file extension to mark encrypted files and then demands at least 0.05 Bitcoin for the alleged decryption tool.

There are two versions of this threat: one is sending the ransom note through a text file, and the other one is using pictures. Both of the versions are based on traditional Chinese language, Bitcoin addresses are the same, and there are no additional differences, so researchers state that the virus is developed and distributed by the same actors.

Some researchers report that WannaRen ransomware is only encrypting files on Windows 10 an the other ones that malware doesn't encrypt files at all. However, malware researchers often check samples on Virtual Machines, so ransomware may not act the same as on the Windows operating system.

This is a serious infection that can damage the machine significantly and affect various parts of the system to ensure the persistence of the ransomware.

There are many victims who ask for help and answers in online forums, so it is known that WannaRen ransomware virus has already affected devices and damaged computers. Some of the reports from victims also state that infection appeared after the installations of the Microsoft Eternal Blue patch. It may indicate that the main distribution technique is pirated software packages, malicious patch files, and other data that include malicious scripts.

WannaRen acts like WannaCry, but there are no other similarities or proven relations between two campaigns or malware creators. It may be the case because WannaCry was one of the most dangerous and active ransomware threats that managed to infect at least 150 countries in 2017 alone.

It caused losses that, in total, go up to $8 billion. It is common to copy other threat actors, especially when it comes to cryptocurrency extortion-based malware.

This virus appears to be in development, and attacks are in early stages, so there might be some additional updates to the coding methods and other functionalities that make the malware more dangerous. This is also the reason why information about the WannaRen virus is limited and not detailed. However, we try to provide you will all the information, so you can know how to fight the infection.

It seems that Windows 7 users are not getting file encryption when WannaRen ransomware manages to get on the machine, but Windows 10 users complain about serious damage to the system, including the file encryption. This file-locking process is achieved by using army-grade encryption algorithms and changing the original coding of the file. In most cases, these threats target files like images, documents, video or audio files, and archives, databases.

You need to remove WannaRen ransomware as soon as possible because even though it mainly relies on common file types there is a huge possibility that other processes that get triggered in the background manage to affect system preferences and folders, functions of the OS.

Once ransomware gets on the computer, these are changes that can get made by the virus itself to ensure the persistence of the infection:

When you decide how to perform the WannaRen ransomware removal, it is crucial when you choose the anti-malware tool because there are separate databases for malware and not all AV detection engines use the same ones, so detection results may differ. Choose the official tool and make sure to use the full system scan option to check all places of the computer.

The anti-malware program offers what to do next when the malware is detected. Double-check after the termination to be sure that the system is virus-free. Then you can run and repair virus damage and recover files that WannaRen ransomware encrypted.

The best method is data backups from cloud or external devices. If you do not have backups, try third-party tools. We have listed a few options below.

• disabled AV tools and security functions;
• added programs and files;
• deleted applications;
• altered registry keys;
• speed and performance issues.

From our report of Apr 2020 · not reviewed since

Clean traces of WannaRen malware from your Windows system

WannaRen ransomware virus might still be in development and get updates or changes in the coding or added other features, so there still can be some missing pieces or even vulnerabilities that allow this threat to get removed by using anti-malware tools. In some cases, such threats can disable AV tools and security programs.

Some users report that it is difficult to remove WannaRen due to the fact that their AV tools are disabled to cannot find the malware file. So reboot the machine in Safe Mode and then run the or program to find and eliminate all traces of this ransomware. You can find some tips on this method below the article.

As for the WannaRen ransomware removal, you can then run steps suggested by the program you use and follow with a thorough system cleaning. Anti-malware tools should find all related programs, but these AV detection engines cannot recover encrypted files or fully clear virus damage. can at least check for affected files and repair any corrupted parts for you. Then you can go through data recovery options.

[GI=method-1]Reboot your device in Safe Mode with Networking before running the AV tool on the machine. This way you remove WannaRen ransomware

[GI=method-2]System Restore feature gives the opportunity to recover a machine to a previous state when the virus was not active

Windows Previous Versions feature recovers individual data

System Restore should be enabled beforehand for Windows Previous Versions to work properly

ShadowExplorer is the method for data recovery after WannaRen ransomware infection

When Shadow Volume Copies are untouched, this feature can be used for data restoring

WannaRen ransomware doesn't have a decryption tool

From our report of Apr 2020 · not reviewed since

Malicious files - in use for ransomware distribution

When malicious actors try to spread their products around as quickly and as wide as it is possible because ransomware creators care about profits and money that they can get from victims directly. Spam campaigns, when file attachments contain malware scripts, are one of the more used methods for such instances.

However, malicious files become more included in pirated software packages and gets installed when users download cracks, cheats, fake software, and license keys. There is no indication about the malicious file if you don't check the install setup for the wanted program or game cheat. This is why the method works.

Victims reported that patches, software, and other pirated content were installed before the ransomware attack. It may be an indication of a particular relation, but you should pay attention to various details if you want to avoid anything like this.

Delete any suspicious emails and do not download questionable files from notifications you were not expected to receive. Experts always note that spam emails can include a handful of viruses, so make sure to check the file and sender before doing anything.