[Virus/Malware Activity Report: Vohuk Ransomware]

A security breach believed to be in the form of Vohuk ransomware has occurred, and
we would like to confirm the situation and provide a warning as follows.

Vohuk ransomware

The ransomware is called Vohuk and appears to be changing all files with the encrypted name.Vohuks extension.

How it works

file version

[Figure 1 File version]

[Figure 2 File properties]

behavioral process

• Register startup program

  Registers itself in the startup program to automatically re-run when Windows starts.

  
  [Figure 3 Startup program registration]

Infection results

The information file is created in each folder under the name R3ADM3.txt, and when encryption is performed, the files are changed to <encrypted name.Vohuk>.

[Figure 4 Infection result 1]

[Figure 5 Infection result 2]

White Defender compatible

It supports real-time automatic restoration of files that will be encrypted before the malicious actions and blocking of White Defender ransomware.

[Figure 6 Block message]

[Figure 7 Block message]

[Figure 8 Block message]

Watch the Vohuk blocking video