Vehu 是什麼類型的惡意軟體?
Vehu is a ransomware variant from the Djvu family that we discovered during an analysis of samples submitted to 病毒總數. 勒索軟體是一種加密檔案並要求付費解密的惡意軟體. 除了加密文件之外, Vehu appends its extension (“.vehu”) 文件名並提供勒索訊息 (“_README.txt“).
An example of how files encrypted by Vehu are renamed: “1..jpg” 更改為 “1.jpg.vehu“, “2.PNG” 到 “2.png.vehu“, 等等. Since Vehu is part of the Djvu family, it may be distributed alongside information stealers like Vidar and RedLine.
Screenshot of files encrypted by Vehu ransomware:
受感染的電腦: VEHU 文件
Vehu ransom note overview
Vehu’s ransom note informs victims that their files are encrypted and that the only way to recover them is to purchase a decryption tool and a unique key. It also says that the attackers offer to decrypt one file (not containing valuable information) for free. The note provides two contact emails: support@freshingmail.top and datarestorehelpyou@airmail.cc.
It provides the price of decryption $999 and says it can be reduced to $499 if victims contact threat actors within 72 小時. Lastly, it ensures victims that data cannot be restored without payment.
Ransom Note: _readme.txt
| 姓名 | Vehu Virus |
| Family 1 | STOP/Djvu Ransomware |
| Extension | .vehu |
| 勒索軟體說明 | _readme.txt |
| 贖金 | 從 $499 到 $999 (比特幣) |
| 接觸 | support@freshingmail.top, datarestorehelpyou@airmail.cc |
| 症狀 |
|
| 恢復 | 從全面的恢復開始 防病毒掃描. 雖然並非所有文件都可以恢復, 我們的指南概述了重新獲得加密文件存取權的幾種潛在方法. |
Djvu 勒索軟體利用多階段 shellcode 發起活動, 導致檔案加密. 另外, 該惡意軟體整合了循環以延長其執行持續時間, 讓安全系統更難辨識惡意軟體.
也, Djvu 勒索軟體利用動態 API 解析來秘密存取重要工具. 之後, 它利用進程空心, 創建自身的副本，偽裝成另一個進程以隱藏其真實意圖.
How Vehu ransomware infect my PC?
網路犯罪分子以各種方式分發勒索軟體. Djvu 勒索軟體通常透過盜版軟體傳播 (或破解工具和金鑰產生器) 以及冒充 YouTube 下載影片平台的可疑頁面. 包含惡意附件和連結的電子郵件也被用作惡意軟體分發管道.
另外, 電腦感染可能透過軟體漏洞發生, 惡意廣告, 受損網站, 路過式下載, USB 隨身碟受損, P2P網路, 非官方頁面, 以及類似的管道. 全面的, 大多數網路犯罪分子的目的是引誘使用者執行導致電腦感染的操作.
How To Remove?
Remove Vehu Virus with Gridinsoft Anti-Malware
從那時起我們就一直在我們的系統上使用這個軟體, 而且在檢測病毒方面一直很成功. 它阻止了最常見的勒索軟體： 從我們的測試中可以看出 與軟體, and we assure you that it can remove Vehu Virus as well as other malware hiding on your computer.
使用 Gridinsoft 刪除惡意威脅, 請依照以下步驟操作:
1. 首先下載 Gridinsoft Anti-Malware, 透過下面的藍色按鈕或直接從官方網站訪問 網格軟體.
2.一旦 Gridinsoft 安裝文件 (安裝-gridinsoft-fix.exe) 已下載, 透過點擊該檔案來執行它. Follow the installation setup wizard's instructions diligently.
3. 訪問 "掃描選項卡" on the application's start screen and launch a comprehensive "全碟掃描" 檢查您的整台計算機. 這種包容性掃描涵蓋了內存, 啟動項, 註冊表, 服務, 司機, 和所有文件, 確保它檢測到隱藏在所有可能位置的惡意軟體.
要有耐心, as the scan duration depends on the number of files and your computer's hardware capabilities. 利用這段時間放鬆或處理其他任務.
4. 完成後, 反惡意軟體將提供一份詳細報告，其中包含您 PC 上偵測到的所有惡意專案和威脅.
5. 從報告中選擇所有已識別的項目，然後放心地單擊 "立即清潔" 按鈕. 此操作將從您的電腦中安全地刪除惡意文件, 將它們轉移到反惡意軟體程式的安全隔離區，以防止任何進一步的有害行為.
6. 如果出現提示, 重新啟動電腦以完成完整的系統掃描過程. 此步驟對於確保徹底消除任何剩餘威脅至關重要. 重啟後, Gridinsoft Anti-Malware 將會開啟並顯示一則訊息，確認 掃描完成.
請記住 Gridinsoft 提供 6 天免費試用. 這意味著您可以免費利用試用期體驗軟體的全部優勢，並防止您的系統將來受到任何惡意軟體感染. Embrace this opportunity to fortify your computer's security without any financial commitment.
影片指南
How To Decrypt .vehu Files?
第一的, 嘗試刪除 “.vehu” 幾個大檔案的副檔名，然後打開它們. 該惡意軟體難以加密大文件. 病毒要么無法在訪問時鎖定文件，要么遇到錯誤而忽略添加文件標記. 如果您的檔案大小超過 2GB, 後一種情況更有可能發生.
犯罪分子在八月底左右發布了最新的擴展 2019 進行多次更改後.
犯罪分子所做的更改使 STOPDecrypter 不再受支持, 導致其被 Emsisoft 開發的 STOP Djvu 勒索軟體 Emsisoft Decryptor 取代.
- 下載並執行解密工具: 下載 解密工具. 確保您以管理員身份執行解密實用程式並同意透過點擊出現的授權條款 “是的” 按鈕. 接受許可條款後.
- 選擇要解密的資料夾: 解密器, 預設情況下, 自動選擇已連接的網路磁碟機上的目錄進行解密. 使用 “添加” 按鈕選擇其他位置. Depending on the malware family, decryptors offer various options, which you can toggle on or off in the Options tab. Below, you will find a detailed list of the currently active options.
- Initiate Decryption by Clicking on the “Decrypt” Button. After adding all desired locations to the list, click the “Decrypt” button to start the decryption process. The decryptor will inform you upon completing the decryption process. If needed for documentation, you can save the report by clicking the “Save log” 按鈕. It’s also possible to copy the report to your clipboard for pasting into emails or messages.
How to Restore .vehu Files?
In some cases, ransomware fails to encrypt your files…
The Vehu ransomware encryption process involves encrypting each file byte-by-byte, creating a duplicate, and then deleting (not overwriting) the original file. This deletion means the physical disk no longer lists the file in its system, although the original file remains on the drive. The sector that held the file might still contain it, but since the system does not list it, new data can overwrite it. However, special software can recover your files.
Realizing it was an online algorithm, I knew recovering my encrypted files was impossible. My backup drive, connected during the infection, seemed infected as well. Every folder on my backup drive appeared encrypted. Despite this, I managed to recover nearly 80% of my 2TB storage.
Examining the folders, I found ransom notes in each. 打開一些發現只有不在子資料夾中的檔案被加密. 深入研究其他資料夾中的子資料夾, 我發現了未加密的文件. 不像我的 C 盤和 D 盤，每個資料夾, 包括子資料夾, 已加密, 我的備份磁碟機的子資料夾已儲存 80% 我的數據.
我認為在我的備份驅動器上發現這個漏洞很幸運. 另外, 我又找回了一個 10% 我的數據來自另一台 PC 上的硬碟. 因此, 我對使用備份磁碟機的建議是建立子資料夾. 部分是運氣, 但不幸的是，在我的備份檔案傳輸過程中病毒襲擊了.
希望這段經歷可以幫助其他有類似困境的人.
傑米紐蘭
Recover Vehu Files with PhotoRec
PhotoRec, designed for file recovery from damaged disks or accidental deletion, now supports restoring 400 file types, making it useful after a Vehu attack.
第一的, download PhotoRec. It’s free, but the developer offers no guarantee for file restoration. PhotoRec comes packaged with TestDisk, another tool from the same developer, under the TestDisk name. However, PhotoRec is included within the archive.
To start PhotoRec, open the “qphotorec_win.exe” 文件. 無需安裝，因為該程式包含所有必需的文件, 允許它從 USB 驅動器運行.
發表評論