Agpo Ransomware Based on STOP/Djvu Code

During our examination of malware samples, we came across Agpo, a variant of the Djvu ransomware family. Agpo utilizes encryption to lock files and adds a new extension (".agpo") to their filenames. Moreover, it generates a ransom note in the form of a text file named "_readme.txt."

As an example, Agpo would modify filenames like "1.jpg" to "1.jpg.agpo" and "2.png" to "2.png.agpo." It's important to note that Djvu ransomware is often distributed alongside information stealers such as Vidar and RedLine.

The ransom note assures victims that they can recover all their encrypted files, stating that various types of files, including pictures, databases, documents, and other critical data, have been locked using robust encryption and a unique key. To regain access to these files, victims must purchase a decryption tool and a unique key.

As a show of their capabilities, the ransomware operators offer victims the opportunity to send one encrypted file from their computers for free decryption. However, this offer is limited to a single file that does not contain valuable information.

The note also specifies the price for obtaining the private key and decryption software, initially set at $980. However, if victims contact the attackers within the first 72 hours, a 50% discount is provided, reducing the price to $490. Victims are instructed to reach out to the attackers through email at support@freshmail.top or datarestorehelp@airmail.cc.

Agpo Asks for $490 in Ransom Payment

The full text of the Agpo ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-3OsGArf4HD
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can You Protect Your Data from Ransomware Like Agpo?

Safeguarding your data from ransomware like Agpo requires a proactive approach and implementing various security measures. Here are some steps you can take to protect your data:

• Regularly Backup Your Data: Maintain frequent backups of all your important files and ensure they are stored securely. Consider using an offline backup solution or a reputable cloud backup service. Regularly test your backups to ensure they are working properly.
• Keep Your Software Updated: Ensure that your operating system, applications, and security software are up to date with the latest patches and security updates. This helps protect against known vulnerabilities that ransomware may exploit.
• Be Cautious with Email Attachments and Links: Exercise caution when opening email attachments or clicking on links, especially if they are from unknown or suspicious sources. Be wary of unexpected or unsolicited emails, as they may contain malicious attachments or lead to infected websites.
• Use Reliable Security Software: Install reputable antivirus and antimalware software on your devices. Keep them updated and run regular scans to detect and remove any potential threats.
• Disable Macros in Office Documents: Disable macros in Microsoft Office documents by default. Macros can be used to execute malicious code and deliver ransomware. Only enable macros from trusted sources when necessary.
• Use Web Filtering: Employ web filtering solutions that can block access to known malicious websites and prevent users from inadvertently visiting infected webpages.