Foza Ransomware Attacks PCs Through File Encryption

During our analysis of malware samples, we identified the Foza ransomware. This ransomware encrypts files and modifies the file names by adding a ".foza" extension to them. Foza also creates a ransom note with the name "_readme.txt". As an illustration, "1.jpg" would be renamed to "1.jpg.foza", and "2.png" to "2.png.foza". It should be noted that Foza is part of the Djvu ransomware family, and may be distributed with other malware like RedLine and Vidar.

The ransom note instructs victims to contact the attackers within 72 hours via two email addresses (support@freshmail.top and datarestorehelp@airmail.cc) to avoid paying a higher ransom of $980 for decryption tools. This amount is double the initial demand of $490. The note also warns that it is impossible to recover encrypted files without purchasing decryption software and a unique key from the attackers. The attackers offer to decrypt a single file for free, but only if it doesn't contain critical data.

Foza Ransom Note Threatens to Double Ransom

The full text of the Foza ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-pSlL2pKijh
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can Ransomware Like Foza Infect Your Computer?

Ransomware like Foza can infect your computer through various means, including malicious email attachments, infected software downloads, and malicious links in phishing emails. Attackers can also exploit vulnerabilities in outdated software or use social engineering tactics to trick users into downloading and installing malware.

One common method used by ransomware attackers is to send phishing emails that appear legitimate and contain infected attachments or links. Once the user clicks on the attachment or link, the ransomware is downloaded and executed on their computer. In some cases, attackers may use exploit kits to exploit vulnerabilities in the user's software and gain access to their system.

Another way ransomware can infect your computer is through drive-by downloads, where malware is downloaded and executed automatically when you visit an infected website. This can happen if you click on a malicious link or banner ad.

To protect your computer from ransomware attacks, it is important to keep your software up to date, use antivirus software, and be cautious of suspicious emails, links, and downloads. Additionally, it is essential to regularly back up your important data to an external hard drive or cloud storage, so you can restore your files in case of a ransomware attack.