Cosw Ransomware is a New Djvu Clone That Seeks Random Files for Encryption

After analyzing malware samples from online threat catalogs, a new variant of the Djvu ransomware has been discovered and named Cosw. Its primary objective is to encrypt files on the affected system and change their names by adding the ".cosw" extension. To provide instructions on paying the ransom and obtaining a decryption tool, Cosw generates a file named "_readme.txt".

It is essential to keep in mind that Cosw can be spread in conjunction with information-stealing malware like RedLine or Vidar. As an example of how Cosw alters file names: it modifies "1.jpg" to "1.jpg.cosw" and "2.png" to "2.png.cosw," and so on.

The ransom note from Cosw lists contact and payment details and urges victims to contact the attackers within 72 hours to pay $490 for the decryption tools instead of $980. The note claims that encrypted files cannot be restored without these tools.

Furthermore, the note advises that victims can submit one encrypted file to the attackers for a free decryption. The "_readme.txt" file lists two email addresses for reaching out to the attackers: support@freshmail.top and datarestorehelp@airmail.cc.

Cosw Asks for a Thousand Dollars in Ransom

The complete text of the Cosw ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-hhA4nKfJBj
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How is Ransomware Like Cosw Usually Distributed?

Ransomware like Cosw is often distributed through various methods such as spam emails, malvertising, exploit kits, or phishing campaigns. In some cases, attackers may exploit vulnerabilities in software or operating systems to gain access to the victim's device and install the ransomware. The attackers may also bundle the ransomware with legitimate-looking software, which is then installed unknowingly by the user.

It is important to be vigilant and avoid opening suspicious emails or downloading unknown software to prevent the installation of ransomware on your system. Keeping your software and operating system up-to-date with the latest security patches can also help prevent exploits from being successful.