Jzie Ransomware Encrypts Files

During our analysis of malware samples, we came across a ransomware variant called Jzie. Jzie has been designed to encrypt files and modify their names by appending the ".jzie" extension. Additionally, Jzie generates a ransom note, which can be located in a file named "_readme.txt."

Jzie changes file names using this pattern: it transforms a file named "1.jpg" into "1.jpg.jzie," "2.png" into "2.png.jzie," and so forth. It's important to note that Jzie belongs to the Djvu ransomware family. Often, cybercriminals distribute Djvu ransomware alongside data-stealing malware like RedLine or Vidar.

The ransom note conveys that the victim can recover all their files, including pictures, databases, documents, and other critical data. The attacker claims to have encrypted these files with a highly secure encryption method. The cybercriminal also asserts that the only way to recover the files is to purchase a decryption tool and the corresponding unique key.

The note also mentions a guarantee: the victim is given the option to send one encrypted file from their PC, and the perpetrator will decrypt it for free. However, this offer is limited to a single file that must not contain valuable information.

The ransom price for obtaining the private key and decryption software is set at $980. However, the attacker offers a 50% discount if the victim initiates contact within the first 72 hours, reducing the price to $490.

To obtain the decryption tool, the victim is instructed to contact the perpetrator using the email addresses support@freshmail.top or datarestorehelp@airmail.cc.

Table of Contents

Jzie Ransom Note in Full

The complete text of the Jzie ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-TAbs6oTGSU
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can Ransomware Like Jzie Infect Your System?

Ransomware, such as Jzie, can infect your system through various methods and vulnerabilities. Understanding how ransomware can infiltrate your system is crucial for prevention. Here are common ways ransomware can infect your system:

Phishing Emails: Phishing emails are a primary vector for ransomware. You may receive an email with a malicious attachment or a link that, when clicked, downloads and executes the ransomware on your system. These emails are often disguised as legitimate messages from reputable sources, tricking users into opening them.
Malicious Downloads: Ransomware can be distributed through deceptive downloads. This includes downloading seemingly harmless files or software from untrustworthy websites or using pirated software, which may contain hidden ransomware.
Exploiting Vulnerabilities: Ransomware can exploit known vulnerabilities in your operating system or software. Ensuring your system is up to date with the latest security patches can help protect against this type of attack.
Drive-By Downloads: Visiting compromised or malicious websites can lead to drive-by downloads, where ransomware is automatically downloaded and executed on your system without your knowledge or consent.
Social Engineering: Attackers may use social engineering techniques to manipulate you into running or installing ransomware. This can include impersonating tech support, claiming your system is infected, and urging you to install their malicious software.
Malvertising: Malicious advertisements, or malvertisements, can contain code that, when loaded in your web browser, can download ransomware to your computer. These ads can appear on legitimate websites.
Infected Removable Media: Ransomware can spread through infected USB drives, external hard drives, or other removable media. Plugging these into your system can introduce the ransomware to your computer.