Aghz Ransomware Will Lock Your Valuable Files

While analyzing new malware samples, our team came across Aghz ransomware, a member of the Djvu ransomware family. This particular ransomware encrypts files and adds the ".aghz" extension to their filenames. Moreover, it creates a "_readme.txt" file that contains instructions for payment and contact information.

It is typical for Djvu ransomware to be distributed alongside information stealers like RedLine or Vidar, which extract sensitive data from compromised systems. Aghz ransomware follows a similar pattern and modifies filenames by appending the ".aghz" extension. For instance, "1.jpg" would become "1.jpg.aghz," and "2.png" would become "2.png.aghz."

The ransom note instructs victims to obtain decryption software and a unique key to regain access to their files. The attackers demand a payment of $980 for these tools, but if victims contact them within 72 hours using the provided email addresses (support@freshmail.top or datarestorehelp@airmail.cc), the payment can be reduced to $490.

Additionally, the note offers victims the option to submit a single encrypted file for a complimentary decryption as a demonstration of their capability before any ransom payment is made.

Aghz Ransom Note Done in Typical Djvu Style

The full text of the Aghz ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-3OsGArf4HD
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can Ransomware Like Aghz Get in Your System?

Ransomware like Aghz can infiltrate your system through various means, and it's crucial to understand these entry points to effectively protect yourself. Here are some common ways ransomware can infect your system:

• Email attachments: One common method is through malicious email attachments. Attackers may send deceptive emails that appear legitimate, often with an urgent or enticing message, and attach infected files. If you unknowingly open the attachment, the ransomware can execute and begin encrypting your files.
• Phishing emails and links: Another technique is phishing, where cybercriminals impersonate reputable organizations or individuals to trick you into clicking on malicious links. These links can lead you to websites that host ransomware, enabling it to infiltrate your system.
• Malicious downloads: Ransomware can be disguised as seemingly harmless software or files available for download on the internet. If you download and execute such files from untrusted sources, you may unknowingly install ransomware on your system.
• Exploiting software vulnerabilities: Ransomware can exploit security vulnerabilities in your operating system or software. If your system is not up to date with the latest security patches, attackers can exploit these weaknesses to gain unauthorized access and deploy ransomware.
• Malvertising: Malicious advertising, or malvertising, involves cybercriminals injecting ransomware into online ads. When you click on such an ad or visit a compromised website, the ransomware can be silently downloaded onto your system.
• Remote Desktop Protocol (RDP) compromise: If you have Remote Desktop enabled on your computer and do not have strong security measures in place, attackers can exploit weak or default passwords to gain access to your system and deploy ransomware.
• Drive-by downloads: Visiting compromised or malicious websites can lead to drive-by downloads, where ransomware is automatically downloaded and executed in the background without your knowledge or consent.