This report is an overview of the new Vovalex ransomware. This malware was discovered by the MalwareHunterTeam and maybe the first known ransomware to be written in the D language. As of now, this malware has been detected being distributed through pirated software that masquerades as legitimate software such as various Windows utilities. The goal of this malware is to encrypt files and demand a ransom from the victim to restore access to the files. This report details the attack, ransomware detection, and mitigation techniques that can be implemented to help protect against the Vovalex ransomware attack.
Vovalex ransomware is a new malware that was recently discovered by the MalwareHunterTeam. The goal of this malware attack is to encrypt files on the victim’s host and demand a ransom for the decryptor. What makes this ransomware attack unique is that it may be the first ransomware written in D Language.
Vovalex is distributed through pirated software such as WinRAR, CCleaner, and uTorrent installers. Once the installer is executed, the ransomware launches the legitimate installer and copies itself to a random file name in the %Temp%folder. Next, the encryption phase begins. Vovalex renames every encrypted file by appending the extension ".vovalex" to each one.
After the files have been encrypted, Vovalex creates a ransom note named README.VOVALEX.txt on the desktop. The note requests 0.5 XMR (Monero) from the victim, which is approximately $69.54, to retrieve a decryptor. The "README.VOVALEX.txt" ransom note also provides the victim with the contact and payment information. This note is written in both English and Russian languages. At the moment, it is unknown if any researchers have discovered the decryption code of this ransomware.
Note: The Avertium Threat Report analyzes one current threat that has been shared by threat intelligence networks across the globe. Used internally by the Avertium CyberOps Team, this report will outline a “top-of-mind” threat and how it ought to be addressed accordingly.
This informed analysis is based on the latest data available.