Wwhu Ransomware Locks Victim Systems

While analyzing malicious software samples, we came across the Wwhu ransomware, which is a member of the Djvu malware family. When it infiltrates a computer, this ransomware encrypts files and appends the ".wwhu" extension to their names. To illustrate, it changes "1.jpg" to "1.jpg.wwhu" and "2.png" to "2.png.wwhu."

Wwhu also creates a ransom note, a text document named "_readme.txt." Additionally, the distribution of Wwhu may involve other types of malware specifically designed for data theft, such as Vidar or RedLine.

The note clarifies that all files, spanning pictures, databases, documents, and other critical data, have undergone encryption using a highly secure method with a unique key. To regain access to these files, victims are instructed to purchase a decryption tool and a key.

The note provides a guarantee by permitting victims to send one encrypted file from their computer, which will be decrypted for free as a demonstration. However, this offer is limited to a single file and should not contain valuable information.

The cost of obtaining the private key and decryption software is $980, with a 50% discount available if victims contact the culprits within the first 72 hours, reducing the price to $490. The note strongly underscores that data recovery will not be possible without payment. It offers two email addresses for communicating with the attackers: support@freshmail.top and datarestorehelp@airmail.cc.

Wwhu Ransom Note Asks for $490 in Payment

The full text of the Wwhu ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-xoUXGr6cqT
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can Ransomware Like Wwhu Infect Your System?

Ransomware like Wwhu can infect your system through various methods, and it typically relies on social engineering tactics and vulnerabilities in your computer's security. Here are some common ways in which ransomware can infiltrate your system:

• Phishing Emails: Cybercriminals often distribute ransomware through phishing emails. You may receive an email that appears to be from a legitimate source, such as a trusted company or a friend, but it contains malicious attachments or links. Clicking on these links or opening infected attachments can lead to the ransomware being downloaded and executed on your system.
• Malicious Websites: Visiting compromised or malicious websites can expose your system to drive-by downloads, where malware, including ransomware, is automatically downloaded and installed on your computer without your knowledge or consent.
• Software Vulnerabilities: Ransomware can exploit vulnerabilities in software, including operating systems and applications. It's crucial to keep your software up to date with security patches to mitigate this risk.
• Freeware and Pirated Software: Downloading software from unofficial sources, cracked versions, or torrent websites can be a vector for ransomware. Cybercriminals may disguise ransomware as cracked software or bundles it with legitimate-looking downloads.
• Remote Desktop Protocol (RDP) Attacks: Attackers may exploit weak or default RDP credentials to gain remote access to your system. Once they have access, they can deploy ransomware and encrypt your files.
• Malicious Advertisements (Malvertising): Malvertisements on websites can lead to ransomware infections. Clicking on a malicious ad may trigger a download or redirect you to a website that initiates a drive-by download.