Vehu Ransomware Locks Infected Systems

We identified Vehu ransomware during our analysis of new malware samples. Our investigation revealed that Vehu is part of the Djvu ransomware family. It encrypts files and appends the ".vehu" extension to filenames, along with presenting a ransom note named "_README.txt". It's important to note that Djvu ransomware is often distributed alongside RedLine, Vidar, or similar malicious software.

For instance, Vehu alters filenames by adding ".vehu" to them, renaming "1.jpg" to "1.jpg.vehu", and "2.png" to "2.png.vehu", and so on.

The ransom note asserts that all files, including pictures, databases, and documents, are encrypted using strong encryption. To regain access to the files, the victim must purchase a decryption tool and key. The decryption tool is priced at $999, but if the victim contacts the attackers within the space of 72 hours, it can be purchased for $499.

Instructions direct the victim to email either support@freshingmail.top or datarestorehelpyou@airmail.cc. It warns that files will not be restored without payment. Furthermore, the note mentions that the victim can send one encrypted file to the attackers and receive it decrypted as a demonstration, provided the file does not contain valuable information.

Table of Contents

Vehu Uses Standardized Djvu Ransom Note

The full text of the Vehu ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
Do not ask assistants from youtube and recovery data sites for help in recovering your data.
They can use your free decryption quota and scam you.
Our contact is emails in this text document only.

You can get and look video overview decrypt tool:

Price of private key and decrypt software is $999.
Discount 50% available if you contact us first 72 hours, that's price for you is $499.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshingmail.top

Reserve e-mail address to contact us:
datarestorehelpyou@airmail.cc

Your personal ID:

How Can Ransomware Infect Your System?

Ransomware can infect your system through various methods, often exploiting vulnerabilities or relying on social engineering tactics. Here are some common ways ransomware can infiltrate your system:

Phishing Emails: One of the most prevalent methods is through phishing emails. Attackers send deceptive emails that appear legitimate, often with attachments or links. Clicking on these links or downloading attachments can download and execute ransomware on your system.

Malicious Links: Cybercriminals can also distribute ransomware through malicious links on websites, social media platforms, or instant messaging apps. Clicking on these links can lead to the download and installation of ransomware.

Exploit Kits: Ransomware can exploit vulnerabilities in software or operating systems using exploit kits. These kits are automated tools used by attackers to identify and exploit weaknesses in software to deliver malware, including ransomware.

Remote Desktop Protocol (RDP) Attacks: Attackers may attempt to gain unauthorized access to systems with weak or default Remote Desktop Protocol (RDP) credentials. Once inside, they can deploy ransomware directly onto the compromised system.

Drive-by Downloads: Ransomware can be downloaded and installed silently when you visit compromised or malicious websites. This method often exploits vulnerabilities in your web browser or plugins.

Malvertising: Attackers use malicious advertisements (malvertising) on legitimate websites to deliver ransomware. Clicking on these ads or even sometimes just viewing them can trigger the download and execution of ransomware.

Software Vulnerabilities: Exploiting unpatched or outdated software vulnerabilities is another way ransomware can infiltrate systems. If you fail to install security updates, your system becomes vulnerable to exploitation by ransomware and other malware.