Mzqt Ransomware Encrypts Most File Types

While analyzing malware samples, we came across a ransomware variant known as Mzqt. This ransomware utilizes file encryption to restrict access to files and appends the ".mzqt" extension to file names. Additionally, it generates a ransom message named "_readme.txt."

Mzqt ransomware is part of the Djvu ransomware family and has connections to information-stealing malware like RedLine and Vidar. To illustrate how Mzqt modifies file names, it changes names like "1.jpg" to "1.jpg.mzqt," "2.png" to "2.png.mzqt," and so forth.

Upon examining the ransom message, it becomes evident that its primary purpose is to provide instructions on how to contact the attackers and initiate a partial payment. The "_readme.txt" file includes two email addresses, support@freshmail.top and datarestorehelp@airmail.cc, along with two ransom amounts: $980 and $490.

The ransom message highlights that victims can obtain decryption tools, including software and a decryption key, at a reduced cost if they reach out to the attackers within a 72-hour timeframe. Furthermore, the message mentions that victims have the option to submit one file for decryption at no cost before proceeding with the payment.

Mzqt Ransom Note Copies Djvu

The full text of the Mzqt ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-sxZWJ43EKx
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can You Protect Your Files from Ransomware Attacks?

Protecting your files from ransomware attacks requires a combination of proactive measures and best practices. Ransomware attacks can be devastating, but taking these steps can significantly reduce your vulnerability:

Regularly Back Up Your Data:
Maintain up-to-date backups of all your important files. Use an automated backup solution and store backups offline or in a secure, isolated environment. Regularly test your backups to ensure they are functioning correctly.

Keep Your Software Updated:
Regularly update your operating system, software applications, and antivirus/anti-malware programs. Many ransomware attacks target known vulnerabilities that can be patched through updates.

Install a Robust Antivirus/Anti-Malware Solution:
Use reputable security software with real-time protection to detect and block ransomware threats. Keep the antivirus/anti-malware definitions up to date.

Exercise Caution with Email and Attachments:
Be cautious when opening email attachments, especially if the email is unexpected or from an unknown sender. Do not click on suspicious links in emails.

Use Email Filtering:
Implement email filtering solutions that can detect and quarantine phishing emails and malicious attachments before they reach your inbox.

Enable Pop-up Blockers and Ad Blockers:
Pop-up blockers and ad blockers can prevent malicious advertisements and pop-ups from delivering ransomware.