Geek's Advice

VLFF ransomware is a virtual menace to your computer files

VLFF ransomware is a newly emerged malicious and highly destructive virus that functions by encrypting files contained in any computer it infects. This latest virus belongs to the infamous STOP/DJVU ransomware group and is known for appending .vlff extension to all the file names. Take for instance, a file that was hitherto saved as 1.jpg will now become 1.jpg.vlff following an infiltration and same will be applicable to all other files. During the attack, ransom notes known as _readme.txt will equally be dropped in all the folders. Contained within these _readme.txt ransom notes are pieces of information sent by those behind the attack, notifying the victim about why and how they should get in touch with them in order to pay ransom and be able to receive VLFF decryption tool.

They will emphasize in the ransom note that VLFF ransomware virus has succeeded in encrypting their entire database, inclusive of documents, pictures and all other files contained in the compromised computer. However, considering that very strong and unique key was used by them, there is no way the victim will be able to decrypt and retrieve their important files except they pay the ransom fee being demanded by the cybercriminals. To facilitate further communication between both sides, two email addresses will also be included in the ransom notes: support@sysmail.ch and supportsys@airmail.cc.

Also included in the note will be the decryption service prices and terms of payment. The cybercriminals will state that the amount payable by the victim will depend on how soon they’re able to do so. For instance, they will inform the victim that even though ransom fee is $980, they would be allowed to pay just 50% of it provided they can make it within 72 hours of being notified i.e. 3 days. However, failure to do so within that timeframe mean only the full ransom fee will be acceptable to them.

If the victim chooses to contact the cybercriminals, more conditions will be dished out by them. They will demand that payment can only be made through the purchase of cryptocurrency that is worth the ransom fee and also transferring same to a wallet address of their choice. The apparent reason why they only accept cryptocurrency is to preempt any possible attempt by law enforcement agencies to track them. As an assurance to the victim, they may even suggest that excerpts of the encrypted files should be sent to them for test decryption.

However, our in-house cybersecurity experts have advised that victims should follow the recommendations outlined by the FBI in respect to ransom demand/payment, and it clearly states that ransom must not be paid to cybercriminals. Some of the basic reasons why ransom payment is strongly condemned are listed below:

• You would most likely lose your money since there is no guarantee that your encrypted files would be eventually decrypted.
• Ransom payment would only encourage cybercriminals to continue wreaking havoc on computer users, thus perpetuating the circle indefinitely.
• More funds available at their disposal would enable them to increase their capacity and victimize more people.

Worse still, this virus is known for dropping other Trojans such as VIDAR and AZORULT on the already compromised computer which they intend to use in stealing vital personal information like Banking Details, Cryptocurrency Wallets, Software Account Credentials, Passwords, Browsing History etc. Such sensitive information in the hands of cybercriminals can lead to further criminal acts such as blackmail and theft.

For those whose computers were unfortunately infected by any of the STOP/DJVU variants, it is very important to remove VLFF ransomware virus as well as all others without delay. The recommended way to go about it is to boot your computer system through Safe Mode with Networking before running any GENUINE antivirus software on it. If you’re not sure of what antivirus to go for, then we strongly advise you make use of INTEGO Antivirus because it has been tested and proven to be exceptional. Also, we suggest you download RESTORO to help in restoring Windows OS files that were damaged by the virus.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Ransomware Distribution Techniques Commonly Used By Cybercriminals

The typical way most computer users infect their systems with any of the STOP/DJVU ransomware variants, including VLFF virus is when they try to download software contents from malicious online torrents. These platforms are often used by cybercriminals whereby they would upload pirated software contents that are embedded with malware and wait for unsuspecting users to download them on their computers. Therefore, opening the so-called “cracks” or key generators are highly risky and can immediately trigger severe ransomware attack. These fake software contents including unauthorized license activation tools are used as baits by these online rogues to get their victims, and the most common ones are listed below:

• Adobe Photoshop;
• Cubase;
• Tenorshare 4ukey;
• AutoCad;
• Various AV software;
• Opera browser;
• Corel Draw;
• Virtual DJ Pro;
• VMware Workstation;
• Fifa 20;
• Adobe Illustrator;
• League of Legends;
• Internet Download Manager;
• KMSPico (illegal Windows activation tool).

For those that participate in this risky activity, now is the time to put a stop to it. Cybercriminals are always looking for computer users with greed tendencies to prey on. There is nothing smart about trying to obtain other people’s copyrighted software contents without paying the official fees attached to them. On the contrary, it could lead to severe loss of important files, time, and resources if/when you eventually become a victim of ransomware. Therefore, you are better off sourcing your software needs legitimately through the official channels endorsed by their respective owners.

Another common method used by cybercriminals in distributing malware is through malicious email attachments. Here, they would compose highly believable messages that would be accompanied with attachments that were crafted with the use of XLS, DOCX and PDF. These ones are preferred by them because they can be used for macro functions and JavaScript, which are suitable for downloading and triggering payload in various computers.

However, in recent times, the most challenging issue is how to detect if an email is genuine or not. This is because cybercriminals have devised means of taking their victims unawares by pretending to be who they’re not. For instance, they would claim to be an acquaintance or even impersonate as a popular brand just to gain the confidence of unsuspecting computer users. The brands they often impersonate are Amazon, eBay, DHL and UPS among several others. They would also give these files compelling names like Tracking Details, Invoice, or Order Summary etc. Alternatively, they may even decide to use email spoofing tricks in obfuscating their actual address. Whatever gimmick they use, it would be in your best interest to apply common sense when checking your inbox, if an email is odd or unexpected, then it should serve as a red flag.

Lastly, STOP/DJVU ransomware victims are advised to shun certain dubious websites that make unsubstantiated claims of providing decryption solutions. The only brands with proven capability to repair/decrypt STOP/DJVU encrypted files are Emsisoft and DiskTuna. Here is a link to how you can make use of them.

More Information about the Virus

For those that are curious to know what happens during VLFF ransomware attack, this section would explain to you in more details. Firstly, what the malware does is to launch build.exe or build2.exe executables as well as winupdate.exe i.e. the Window display showing fake update screen. After that, the virus will connect to https[:]//api.2ip.ua/geo.json before saving the response in geo.json file. The malware then commences information gathering by gathering data such as the computer’s geolocation, time zone, zip code, longitude and latitude, and will save such information in the geolocation-related database. The example provided below is an image showing a couple of geo.json file samples.

It will also create another file that will contain installed software list and hardware details. This file will be named as information.txt.

At this point, the virus will profile the geolocation information it obtained against a list of countries they certified as encryption-exempted. The countries are listed as follows: Russian Federation, Ukraine, Kyrgyzstan, Belarus, Syria, Armenia, Tajikistan, Kazachstan and Uzbekistan. Peradventure it happens that such computer is located in any of the countries listed above, it will immediately cease any further action. If on the other hand it scales through, an online encryption key would be extracted from their C&C server and would be combined with the victims ID, and they would be saved in a file named bowsakkdestx.txt. Additionally, the virus saves the victim’s ID or several of them to PersonalID.txt file. Examples of these files are shown below.

If for any reason the virus wasn’t able to extract online encryption key from their server, it will instead opt for a hardcoded offline key which would be the same for all victims (this situation would be preferable to victims since it enhances their chance of decrypting .vlff files in the future). You can detect if an offline key was used if it contains t1 characters appended to the victim’s personal ID. More information about this is provided below this article.

The ransomware will now commence full data encryption by scanning every folder and encrypting them with Salsa20 before locking them with RSA-2048 key. While this is ongoing, the virus will also mark the files with new extension.

Here is a screenshot of _readme.txt ransom note that is traditionally left in all the folders.

To complete the entire process, the virus will send a list of domains to the Windows HOSTS file and also forwards them to the local host IP. Once this is done, the victim won’t be able to access any of the blacklisted sites and if they try to browse any of them, DNS_PROBE_FINISHED_NXDOMAIN error message would come up on the screen. The reason is to prevent the victim from getting help online.

Remove VLFF Ransomware Virus and Recover Your Files

Victims, whose files were encrypted by this virus, should not hesitate and remove VLFF ransomware virus remains ASAP. However, do not forget to use Safe Mode with Networking option as well as a genuine antivirus software such as INTEGO Antivirus. Additionally, we typically advise downloading RESTORO to repair virus damage on Windows OS files.

Now you’ve removed VLFF ransomware, it is time to take the following steps:

• Report to the nearest office of government responsible for handling such challenges.
• Make use of any available backup device to re-upload lost data.
• Learn possible ways files locked by STOP/DJVU ransomware versions can be repaired/decrypted.
• Change every password that was connected through the compromised computer.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.