Mzhi Ransomware Will Lock Your Files

During the examination of new malware samples, a variant of the Djvu ransomware, known as Mzhi, has been identified. Mzhi operates by encrypting files and adjusting their file names by appending the ".mzhi" extension to them. Furthermore, Mzhi is designed to create a text document called "_readme.txt," which contains a ransom message.

Typically, Djvu ransomware is distributed alongside information-stealing malware like RedLine or Vidar by malicious actors. As an illustration of how Mzhi alters file names, it transforms "1.jpg" into "1.jpg.mzhi," "2.png" into "2.png.mzhi," and so forth.

The ransom message delivered by the attackers provides two email addresses, support@freshmail.top and datarestorehelp@airmail.cc, and strongly advises victims to establish contact with the cybercriminals within a 72-hour window to prevent an escalation in the ransom amount. Initially, the demanded payment for the decryption tools is set at $490.

Additionally, the message underscores that retrieving the encrypted files is unfeasible without obtaining the decryption software and a unique key from the attackers. Furthermore, it offers an option to decrypt a single file at no cost, with the stipulation that the chosen file should not contain valuable data.

Mzhi Ransom Note Asks for Ransom of $490

The full text of the Mzhi ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-sxZWJ43EKx
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How is Ransomware Like Mzhi Distributed?

Ransomware like Mzhi is typically distributed through various methods, with cybercriminals employing tactics to trick or coerce victims into downloading and executing the malicious code. Here are some common distribution methods for ransomware:

• Phishing Emails: Phishing emails are one of the most common methods. Attackers send emails that appear legitimate, often mimicking well-known organizations or individuals. These emails contain malicious attachments or links that, when clicked, download and execute the ransomware.
• Malicious Websites: Cybercriminals may set up fake or compromised websites that contain exploit kits. These kits target vulnerabilities in the victim's web browser or plugins and deliver ransomware without the victim's knowledge.
• Drive-By Downloads: This method involves infecting legitimate websites with malicious code. When a user visits the compromised website, the malware is silently downloaded and executed on their system.
• Malvertising: Attackers may use online advertising networks to distribute malicious ads. When a user clicks on a malicious ad, it can lead to a ransomware download.
• Remote Desktop Protocol (RDP) Attacks: Attackers may use brute force attacks to gain access to a victim's computer or network through RDP. Once inside, they can manually install ransomware.
• Exploiting Software Vulnerabilities: Some ransomware strains exploit known vulnerabilities in operating systems or software applications. This can happen when users fail to update their software with security patches.
• Social Engineering: Cybercriminals may use social engineering tactics, such as impersonating tech support, to convince victims to download and execute malicious files.
• File-Sharing Networks: Ransomware can also spread through peer-to-peer (P2P) file-sharing networks, where users unknowingly download infected files.