Cdxx Ransomware is Based on Djvu

While going over malware samples, we discovered that Cdxx is a member of the Djvu ransomware family with its primary goal being data encryption. It follows a pattern of appending the ".cdxx" extension to filenames during encryption (e.g., transforming "1.jpg" into "1.jpg.cdxx" and "2.png" into "2.png.cdxx").

It is important to note that Djvu ransomware is often distributed alongside information stealer malware. The accompanying ransom note, named "_readme.txt," assures victims of the full recovery of all files, encompassing images, databases, and vital documents. The encryption involves robust algorithms and a unique key, and the note asserts that the sole means of file restoration is through obtaining a dedicated decryption tool and key.

The ransom note proposes a complimentary decryption of one file with the stipulation that the selected file should lack valuable information. The specified cost for acquiring the private key and decryption software is $1999, with a 50% discount available if contact is initiated within the initial 72 hours, thereby reducing the price to $999.

A warning in the note emphasizes that data restoration is unattainable without payment. To procure the essential tools, the victim is directed to reach out to the email address support@freshingmail.top (or datarestorehelpyou@airmail.cc).

Table of Contents

Cdxx Ransom Note Copies Djvu Format

The complete text of the Cdxx ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted
with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-iVcrVFVRqu
Price of private key and decrypt software is $1999.
Discount 50% available if you contact us first 72 hours, that's price for you is $999.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshingmail.top

Reserve e-mail address to contact us:
datarestorehelpyou@airmail.cc

Your personal ID:

How Can Ransomware Find Its Way on Your System?

Ransomware can find its way onto your system through various means, and attackers often employ sophisticated methods to exploit vulnerabilities. Understanding these potential entry points can help you take steps to mitigate the risk of a ransomware infection. Here are common ways ransomware can infiltrate systems:

Phishing Emails:
One of the most common methods is through phishing emails. Attackers send malicious emails containing links or attachments that, when clicked or opened, download and execute the ransomware on the victim's system.

Malicious Email Attachments:
Ransomware may be disguised as attachments in seemingly harmless emails. Opening these attachments can trigger the execution of the malicious code.

Malicious Links:
Clicking on malicious links, either in emails, instant messages, or on websites, can lead to the download and installation of ransomware on the user's system.

Malvertising:
Cybercriminals can compromise legitimate online advertisements with malicious code. Visiting a compromised website or clicking on a malicious ad can result in ransomware infections.

Exploiting Software Vulnerabilities:
Ransomware may exploit vulnerabilities in outdated software or operating systems. Regularly updating software helps patch these vulnerabilities and enhances security.

Drive-by Downloads:
Visiting compromised or malicious websites can trigger automatic downloads of ransomware onto your system without your knowledge.

Social Engineering Attacks:
Attackers may use social engineering tactics to manipulate individuals into taking actions that lead to ransomware infections. This could involve tricking users into providing login credentials or running malicious scripts.