Geek's Advice

VTYM ransomware description: a virtual menace to your files stored on the computer

VTYM ransomware virus is the latest malicious and highly destructive file-encrypting virus to emerge from the notorious STOP/DJVU ransomware family. After encrypting files contained in any computer it infects, it will append each one with .vtym extension. For example, a file that was earlier saved as 1.jpg will be automatically renamed 1.jpg.vtym. To inform the victim about the malware operators’ intentions, ransom notes known as _readme.txt will be dropped in all the folders. Contained in the ransom notes are pieces of information sent by the cybercriminals to the victim, notifying them about the situation and why they should be contacted and ransom paid as well in exchange for VTYM decryption tool.

The attackers will explain in the ransom note that VTYM ransomware virus was able to encrypt the entire files including pictures, documents, and every other data contained in the infected computer. Not only that, but they will also claim to have made use of a very strong and unique encryption key that can’t be breached unless the victim pays a certain amount of money as ransom. Also included will be two email addresses namely: support@sysmail.ch and supportsys@airmail.cc which the victim is expected to respond with.

Decryption service prices and terms of payment will also attached to the ransom notes. They will state that the amount of money the victim will be required to pay as ransom will depend on how fast they are able to make the transfer. For instance, if they are able to do so within 3 days or 72 hours of being notified, it will enable them to leverage 50% which would bring the ransom fee down to $490 but once the deadline is exceeded, only the full ransom fee of $980 will be acceptable.

More conditions will be reeled out to the victim if they decide to get in touch with the cybercriminals, and it will state that ransom money could only be paid by transferring the crupocurrency equivalence to wallet address of their choice. The obvious reason why they use such an anonymous medium of payment is to preempt any possible move by law enforcement agents to come after them. As a way of showing their capability to restore the victim’s encrypted files and encourage them to pay up without hesitation, they may request for excerpts of file to be sent to them for test decryption but will emphasize that such excerpt must not contain information that could be seen as vital to the victim.

Whatever be the case, our cybersecurity experts advise that victims should follow FBI guidelines in respect to ransom payments and the general consensus is that RANSOM MUST NOT BE PAID. The reason is that paying ransom does not guarantee that victim’s encrypted data would be recovered. Secondly, doing so would only encourage cybercriminals to continue in their criminal activities since they would find it lucrative. Also, more funds at their disposal would enable them to employ more rogue developers and the circle will continue as more computer users are made victims.

The virus equally drops other Trojans that steal information like AZORULT and VIDAR on the already compromised computer, which they use to steal sensitive information such as software account credentials, cryptocurrency wallets, banking details, passwords, browsing history etc. Once these sorts of information are in the hands of the cybercriminals, it can even lead to further criminal acts such as blackmail and theft.

For those that are already infected with STOP/DJVU variant, the most important thing to do is to remove VTYM ransomware virus from the computer without any delay. This can be done effectively by running updated antivirus software while the affected system is set up in Safe Mode with Networking. However, it is very important to make use of only strong and genuine antivirus to ensure optimal results. Therefore, if you’re not sure of what antivirus to use, then we highly recommend INTEGO Antivirus.

Additionally, you may also consider downloading RESTORO which could be used to reverse the damaging effects of the virus on your Windows OS files.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Ransomware distribution techniques used by cybercriminals

The most prolific method used by cybercriminals in spreading STOP/DJVU ransomware including the VTYM virus is when they lure victims to download malicious software programs from online torrents platform. The cybercriminals tent to hide the threats in some of these pirated contents such as key generators and “cracks”, but they become triggered once downloaded in any computer. A good number of victims have reported several particular software programs as often by often used by cybercriminals in spreading malware through online torrent libraries, and they are listed below in no particular order:

• KMSPico (illegal Windows activation tool);
• Fifa 20;
• Tenorshare 4ukey;
• AutoCad;
• Opera browser;
• Corel Draw;
• VMware Workstation;
• Cubase;
• Adobe Illustrator;
• League of Legends;
• Internet Download Manager;
• Adobe Photoshop;
• Virtual DJ Pro.

From the explanations so far, it has become obvious that visiting online torrents software in search of pirated malicious software content is not only a dangerous act but also illegal and punishable by law. Therefore, instead of looking for cheap or free software contents that would put you at risk of cyber-attack, it is better to encourage the genuine producers who went the extra mile to create such contents by patronizing them. You have to put into consideration that whatever amount they place on such contents would always be insignificant when compared to the actual ransom fees cybercriminals demand from their victims. Also, neither will you be at risk of losing your important documents.

Another method used to spread malware is malicious email attachments, whereby they create highly convincing messages that would be accompanied with certain documents formatted with the use of XLS, DOCX and PDF among others. These particular platforms are used because they allow JavaScript/macro functions, both of which can be used to attach, transport and trigger malware in diverse computers.

The worrisome part of it is that one can’t easily tell apart whether a particular email is genuine or a malware carrier sent by cybercriminals. To make them even more believable, the rogues often impersonate popular corporations like Amazon, DHL, eBay, UPS, FedEx etc. and would use catchy captions like Order Summary, Invoice, and Tracking Details among others. Similarly, they may decide to make such emails appear like what colleagues, friends or just anyone close to the victim could send. Alternatively, they may use email spoofing to hide the real sender’s address all in a bid to throw the victim off-balance. Whatever deceptive method they may try to use, it would be in your best interest to avoid opening any email that seem odd to you.

Lastly, victims of any variant of STOP/DJVU ransomware are hereby advised to shun any suspicious website that may make bogus claims about offering such services. The reason is because such services rarely exist, and at the moment only Emsisoft and DiskTuna have proven beyond doubt of their expertise in decrypting STOP/DJVU encrypted files. Trying to make use of any other brand aside these two, can lead to double file encryption.

More details you need to know about the infection

Oftentimes, some victims do wonder about the extent to which VTYM ransomware attack must have affected their system or the exact things that took place while the attack was ongoing. Firstly, you should be aware that the initial action taken by the malware is to set up build.exe or build2.exe executables and would be followed by the winupdate.exe (the prompt brings up fake Windows screen). Following that, it then makes a connection with https[:]//api.2ip.ua/geo.json and would save the response in geo.json. It then proceeds to information gathering stage where details like the computer’s geolocation, time zone, zip code, latitude and longitude would all be sent to geolocation-related database. Here is an example of how geo.json files appear as shown in the image below.

The ransom-demanding malware also creates another file called information.txt that contains hardware details, installed software list and active processes.

Now it has gotten hold of the computer’s geolocation, the malware will now profile it against a list of countries they designated as encryption-exempted. The countries are listed as: Ukraine, Russian Federation, Syria, Tajikistan, Kazachstan, Kyrgyzstan, Armenia, Uzbekistan and Belarus. If it shows that the computer under attack is domiciled in any of these countries, it would instantly abort its mission. If otherwise, it will move to the next stage where it will request online encryption key from the C&C server and then merge it with the victim’s ID, both being saved into bowsakkdestx.txt file and the ID separately to PersonalID.txt file. Shown below are examples of these files.

In situations whereby it fails to extract online encryption key from their server, it will opt for the use of a hardcoded key, also known as offline key, as an alternative. The major difference between these two encryption types is that online keys are uniquely created for each victim while offline key is a one-size-fits-all key that is given to every victim of a particular ransomware variant. What shows if a particular is offline is the addition of t1 characters suffixed to the victim’s personal ID. From the victim’s perspective, offline key is more desirable because it offers a higher chance of being decrypted. More information about this is provided below or in this guide.

Having gotten to this point, the virus will now begin full data encryption process by scanning every folder and encrypting files with Salsa20. It then makes use of RSA-2048 to lock the encryption key. Also, while this ongoing, the virus will mark files with additional extension. This ransomware variant appends .vtym extension to make files distinguishable.

Shown below is a screenshot of _readme.txt ransom note that is usually left in all the folders.

Before completing the entire process, the malware will blacklist some websites in the Windows HOSTS file and also map them to localhost IP which effectively bars the victim from accessing them and any attempt would likely bring up DNS_PROBE_FINISHED_NXDOMAIN error message.

Remove VTYM Ransomware Virus and Retrieve Your Files

Like we stated earlier, victims should as a matter of urgency remove VTYM ransomware from the infected computer with immediate effect. You can use any reliable antivirus solution you want, but if you want to rely on our team’s recommendations, we suggest using INTEGO Antivirus. Additionally, you may want to download RESTORO and use it to repair virus damage on Windows OS files.

Once VTYM ransomware virus removal is taken care of, the following steps should be taken by the victim as recommended by our team:

• Report to local law enforcement agents nearest to you.
• Make use of data backup to recover lost files.
• Learn possible ways STOP/DJVU encrypted files could be repaired.
• Change all passwords used on the compromised computer without delay.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.