Itqw Ransomware Demands Initial Ransom of $490

While analyzing newly submitted malware samples, we came across a type of ransomware known as Itqw. This malicious software is responsible for encrypting files and altering their names by appending the ".itqw" extension. Additionally, Itqw generates a ransom note, labeled as "_readme.txt."

Itqw changes file names by transforming them in the following way: for example, it converts a file like "1.jpg" to "1.jpg.itqw" and "2.png" to "2.png.itqw." It's important to note that Itqw is affiliated with the Djvu ransomware family and may be distributed by malicious actors alongside data-stealing malware like RedLine or Vidar.

In the ransom note, victims are assured that they can recover access to their encrypted files. The note explains that various types of files, such as images, databases, and critical documents, have been locked using a robust encryption method and a unique key. The only means to unlock these files is by obtaining a decryption tool and the corresponding unique key.

The note guarantees that this software can decrypt all the locked files. To instill some confidence, the attackers offer to decrypt one file for free if victims send an encrypted file from their computers. However, this free decryption is limited to a single file that should not contain valuable information.

The attackers have set the price for the private key and decryption software at $980. They provide a 50% discount for those who contact them within the first 72 hours, reducing the price to $490. The note strongly underscores that data recovery will be impossible without payment. It offers two email addresses for reaching out to the cybercriminals: support@freshmail.top and datarestorehelp@airmail.cc.

Itqw Ransom Note in Full

The full text of the Itqw ransom note goes as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-cGZhpvUKxk
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How is Ransomware Usually Distributed Online?

Ransomware is typically distributed online through various methods, and cybercriminals are continually evolving their techniques. Here are some common ways ransomware is distributed:

• Phishing Emails: Phishing emails are one of the most prevalent methods for distributing ransomware. Attackers send seemingly legitimate emails that contain malicious attachments or links. When unsuspecting users open the attachment or click the link, ransomware is downloaded and executed on their system.
• Malicious Email Attachments: Ransomware may be hidden within attachments in emails, often disguised as invoices, resumes, or documents. Once the attachment is opened, the ransomware is unleashed on the victim's computer.
• Malvertising: Malvertising involves spreading ransomware through malicious advertisements on legitimate websites. Users can become infected when they click on these ads, which redirect them to websites where ransomware is automatically downloaded and executed.
• Drive-By Downloads: Cybercriminals may compromise legitimate websites and inject malicious code into them. When users visit these compromised sites, the ransomware is downloaded onto their devices without their knowledge or consent.
• Exploit Kits: Exploit kits are software packages that target vulnerabilities in a user's operating system or software. When a user visits a compromised website, the exploit kit identifies vulnerabilities and delivers the ransomware payload.
• Social Engineering: Cybercriminals use various forms of social engineering to trick users into downloading or executing ransomware. This can include fake software updates, fraudulent alerts, or enticing offers.