Onion ransomware: decrypt .onion virus extension files

The .onion file virus appears to be the latest incarnation of the Dharma ransomware, a high-profile threat using cryptography to take data hostage.

The CrySiS / Dharma ransomware family is one of the old stagers on the arena of online extortion. It stands out from the rest in a couple of ways. The cybercriminals in charge have released master decryption keys for their toxic offspring twice: in November 2016 and March 2017. These moves have allowed security labs to cook up free decryptors to help victims sort things out. The motivation for doing so still being a mystery, the crooks keep updating their perpetrating program regardless. A recent instance of fine-tuning has brought about quite noteworthy alterations. The ransomware now blemishes skewed files with the .onion extension preceded by victim ID and the bad guys’ email address.

This type of transformation makes a file named CV.doc assume the shape of the following entry: CV.doc.id-55184EF3.[volantem_diem@aol.com].onion. The ID is going to be unique for every plagued user, and the email address in this extension may to vary depending on the specific campaign. Aside from the one above, some of the reported strings in square brackets include felix_dies@aol.com, nicecrypt@india.com, and 3048664056@qq.com. Obviously, there are more. The Onion ransomware goes with a built-in list of file formats to target in the course of the attack. To spot all matches on a contaminated machine as well as network and removable drives, it runs a scan as soon as the trespass has taken place. The pest then applies asymmetric cipher to scramble the structure of the victims’ personal files and thus completely deny access to them.

The IOCs (indicators of compromise) in this scenario also include what’s called “ransom notes”. These are files with point-by-point instructions regarding data recovery. The Onion strain of the Dharma ransomware drops the following how-to’s inside encrypted folders and onto the desktop: Info.hta and Readme.txt. The former is an HTML application opening up in a separate window whose title coincides with the email address concatenated to hostage data values. The body of the message goes, “All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the email volantem_diem@aol.com.” Again, the email is a variable attribute that will switch from campaign to campaign.

Ultimately, the victim is instructed to send their personal ID to the attackers and follow a walkthrough received in response. The extortionists also provide a free decryption option for up to five files as long as their total size is less than 10 MB and they don’t contain any valuable information. The size of the ransom requested by the .onion file virus ranges from $500-$1,000 worth of Bitcoin. Essentially, that’s the cost of the victim-specific private RSA key and the automated decryption service. Of course, even if data restoration is successful after paying the ransom, that’s a cold comfort for the user who has to redeem files that belong to them anyway. The workaround below that may do the trick without your having to fund the felons’ business, so it’s definitely worth a shot.

Onion ransomware automated removal and data recovery

When faced with ransomware like Onion, one of the best shortcuts in terms of removal is to use Combo Cleaner, a lightweight and incredibly effective application with PC security and optimization features under the hood. It detects and thoroughly deletes threats while giving you insights into the overall health of your computer.

This program’s protection power spans modules that forestall all known types of malware, including ransomware and browser hijackers, and take your online security to the next level by blocking phishing sites and other suspicious web pages. Follow these simple steps to eliminate the infection for good:

1. Download Combo Cleaner installer.

Download Onion remover

^{Combo Cleaner scans your PC with no strings attached, but you’ll have to buy its fully functional version to remove the threats it detects. The disk optimization tools that find large files and duplicates are free to use.}

2. Open the CCSetup.exe file to get started. Several subsequent screens will allow you to make initial customizations so that the program works exactly as you need from the get-go.

3. The installation will be followed by an update of malware signatures. Once this process is through, click the Start Scan button in the left-hand sidebar.

4. Combo Cleaner will then check system locations that are most often polluted by Windows malware. The first scan can take a while to finish.

5. Combo Cleaner will display a system tray notification as soon as the scan is over. Click the Resolve found threats button to view the results.

6. The scan summary shows the names and types of the detected threats as well as their statuses and locations. Click the Remove all threats button and follow further on-screen prompts to get rid of these items.

Data recovery toolkit to the rescue

Some strains of ransomware are known to delete the original files after the encryption routine has been completed. As hostile as this activity appears, it can play into your hands. There are applications designed to revive the information that was obliterated because of malfunctioning hardware or due to accidental removal. The tool called Stellar Data Recovery features this type of a capability and therefore it can be applied in ransom attack scenarios to at least get the most important files back. So use the app to get an idea of what data can be restored and let it do the recovery job. Here is a step-by-step walkthrough:

1. Download and install Stellar Data Recovery.

Download Stellar Data Recovery

2. Open the application, select the types of recoverable files to look for, and click Next.

3. Choose the areas you want the tool to recover from and click the Scan button.

4. Having scanned the specified locations, the program will display a notification about the total amount of recoverable data. Close the dialog and click the Recover button. This will hopefully help you get some of your valuable files back.

Onion ransomware manual removal and file recovery

Some ransomware strains terminate themselves after completing the encryption job on a computer, but some don’t. Furthermore, the Onion virus may prevent victims from using popular antimalware tools in order to stay on board for as long as possible. Under the circumstances, it may be necessary to utilize the Safe Mode with Networking or System Restore functionality.

Be advised that even after the ransomware is removed, files will still be encrypted and inaccessible. The malicious code cleanup part, however, is important because it keeps a relapse of the infection from occurring further on and eliminates all opportunistic malware.

Ways of non-ransom recovery of .onion extension files

Cracking the crypto used by this ransom Trojan is more of a science fiction thing rather than an attainable prospect for the masses. This is why the troubleshooting in predicaments of this sort is a matter of two approaches: one is to pay the ransom, which isn’t an option for many victims; and the other is to apply instruments that take advantage of the ransomware’s possible weaknesses. If the latter is your pick, the advice below is a must-try.

Ransomware Prevention Tips

To avoid Onion ransomware and other file-encrypting infections in the future, follow several simple recommendations:

These techniques are certainly not a cure-all, but they will add an extra layer of ransomware protection to your security setup.

Revise your security status

Post-factum assessment of the accuracy component in malware removal scenarios is a great habit that prevents the comeback of harmful code or replication of its unattended fractions. Make sure you are good to go by running an additional safety checkup. Another benefit of using the antimalware tool is that it will keep ransomware threats from intruding on your computer further on.

Download Onion removal tool