Ccza Ransomware Doubles Ransom After 72 Hours

Ccza is yet another newly discovered Djvu ransomware variant. The new strain does little different compared to every other recent ransomware clone based on Djvu code.

The Ccza ransomware encrypts almost every file on the victim system, leaving only Windows files intact, to ensure continued system operation. Documents, media files, archives and databases all get encrypted and are rendered unusable.

Encrypted files receive the ".ccza" extension appended to their names. This process will make a file called "waterfall.jpg" transform into "waterfall.jpg.ccza" upon encryption.

The ransomware deposits its ransom note inside a text file with the name "_readme.txt", asking for $490 in initial ransom, upping that sum to $980 if the ransom is not paid within 72 hours.

The full text of the ransom note goes as follows:

ATTENTION!
Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-HZpuxNJt6L
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.
To get this software you need write on our e-mail:
support at bestyourmail dot ch
Reserve e-mail address to contact us:
datarestorehelp at airmail dot cc
Your personal ID: