It is only possible to recover files for free if victims have a data backup or a working third-party decryption tool. Typically, victims cannot decrypt files without tools purchased from threat actors. Cybercriminals deploy other malware before encrypting files to steal sensitive information and perform other malicious activities. Victims are provided with two email addresses that they can use to write threat and More about Djvu and other ransomwareĭjvu ransomware is often seen with other malware (e.g., Vidar Stealer and RedLine Stealer). Their price depends on how fast victims will contact the attackers (victims are given 72 hours to contact them so they can purchase decryption tools cheaper). The ransom note says that victims cannot decrypt files without decryption software and a unique key that can be purchased for $980 or $489. Screenshot of files encrypted by Towz ransomware:
This ransomware was discovered while inspecting malware samples submitted to VirusTotal.Īn example of how Towz modifies filenames: it renames " 1.jpg" to " 1.jpg.towz", " 2.png" to " 2.png.towz", " 3.exe" to " 3.exe.towz", and so forth. towz" extension to filenames and creates the " _readme.txt" file (a file containing contact and payment information). Our team discovered another Djvu ransomware called Towz that encrypts files to make them inaccessible until a ransom is paid.
0 kommentar(er)
