Vo_ Ransomware
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Ranking: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Threat Level: | 80 % (High) |
| Infected Computers: | 146 |
| First Seen: | December 7, 2016 |
| Last Seen: | April 26, 2022 |
| OS(es) Affected: | Windows |
The Vo_ Ransomware was discovered in December 2016, five months after the SQ_ Ransomware emerged on security reports. Both threats are encryption Trojans that are delivered to potential victims via spam emails. Additionally, the Vo_ Ransomware is a slightly improved version of the SQ_ Ransomware, and both Trojans come from the same developers according to security experts. The spam emails carrying the dropper for the Vo_ Ransomware appear to feature logos from banks and online stores and urge the user make a payment referred in the invoice attached. Needless to say, users are asked to open a macro-enabled document, which is designed to install the Vo_ Ransomware Trojan in the background.
The Vo_ Ransomware and the SQ_ Ransomware are the Two Faces of One Crypto Malware
When the Vo_ Ransomware is installed, it determines what type of drives can be accessed and how many files should be encrypted. The Vo_ Ransomware is designed to target data that is associated with text, images, spreadsheets, eBooks, presentations, audio and video. Analysts report that the Vo_ Ransomware combines the AES and RSA ciphers into its functionality. The Vo_ Ransomware creates a unique AES-256 encryption key, which is used to lock data on local and removable drives that are not read/write protected. When the operation is complete, the private key is encrypted with the RSA-1024 algorithm and sent with a POST request via HTTP protocol to the 'Command and Control' server. Affected files can be recognized by the 'Vo_' prefix placed before the original file name. For example, 'what is the speed of light.pptx' is transcoded to 'Vo_what is the speed of light.pptx,' and a white icon would be used instead of a thumbnail for the presentation. The managers behind the Vo_ Ransomware store these keys and users are left with a ransom note in the My Documents directory. The payment instructions are left by the Vo_ Ransomware in the form of 'VO_ IN DOCUMENTS..txt,' which reads:
'Good morning.
Your computer has been locked by ransomware, your personal files are encrypted and you have, unfortunately "lost" all your pictures, files, and documents on the computer. Your important files encryption produced on this computer: videos, photos, documents, etc.
Encryption was produced using unique public key RSA-1024 generated for this computer. To decrypt files you need to obtain the private key.
All encrypted files contains VO_
Your number: [15-digit number]
To obtain the program for this computer, which will decrypt all files, you need to pay
4 bitcoins on our bitcoin address [34 random characters] (today 1 bitcoin was 260 USA dollars). Only we and you know about this bitcoin address.
You can check bitcoin balanse here - https://www.blockchain.info/address/[a string of 34 random characters]
After payment send us your number on our mail pwwu@ruggedinbox.com and we will send you decryption tool (you need only run it and all files will be decrypted during 1...3 hours)
Before payment you can send us one small file (100..500 kilobytes) and we will decrypt it - it's your garantee that we have decryption tool. And send us your number with attached file.
We dont know who are you. All what we need - it's some money.
Don't panic if we don't answer you during 24 hours. It means that we didn't received your letter (for example if you use hotmail.com or outlook.com
it can block letter, SO DON'T USE HOTMAIL.COM AND OUTLOOK.COM. You need register your mail account in www.ruggedinbox.com (it will takes 1..2 minutes) and write us again)'
The Ransom Note that Comes with the Vo_ is Provided in English and Korean
The authors of the Vo_ Ransomware may want to go international and use English and Korean to reach out to victims. Reports from AV vendors suggest that most compromises involving the Vo_ Ransomware are centered around South Korea. However, there are samples of the Vo_ Ransomware that were found in spam emails sent to users in the Western hemisphere. We are yet to see a rise in attacks using the Vo_ Ransomware. It is recommended that PC users make backups, configure a backup program and make sure their archives are stored on a protected drive, preferably a USB drive as it can be easily disconnected. You should consider boosting your cyber defenses by installing a credible anti-spyware tool that can detect and block suspicious connections.
Submit Comment
Please DO NOT use this comment system for support or billing questions. For SpyHunter technical support requests, please contact our technical support team directly by opening a customer support ticket via your SpyHunter. For billing issues, please refer to our "Billing Questions or Problems?" page. For general inquiries (complaints, legal, press, marketing, copyright), visit our "Inquiries and Feedback" page.