Mzre Ransomware Encrypts Files

While examining new malware samples, we came across Mzre, a ransomware variation associated with the Djvu family. Mzre encrypts files, adds the ".mzre" extension to their file names, and creates a ransom note labeled "_readme.txt."

To illustrate how Mzre modifies file names, it transforms "1.jpg" into "1.jpg.mzre," "2.png" into "2.png.mzre," and so forth. It's worth noting that Mzre, being part of the Djvu ransomware family, may be distributed alongside information-stealing malware like Vidar and RedLine.

The ransom note provides details on how to establish contact with the perpetrators and outlines the decryption costs. Victims are instructed to reach out to the threat actors via datarestorehelp@airmail.cc or support@freshmail.top to receive further instructions on obtaining the decryption software and key.

The note specifies two different ransom amounts: $980 and $490, indicating that victims have the option to acquire the decryption tools at a reduced rate if they initiate contact with the attackers within a 72-hour window.

Mzre Ransom Note Asks for $490 in Payment

The full text of the Mzre ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-sxZWJ43EKx
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can You Protect Your Valuable Files from Ransomware?

Protecting your valuable files from ransomware is essential to prevent data loss and potential financial harm. Here are some important steps you can take to safeguard your files:

Regularly Back Up Your Data:
Perform regular backups of your important files to an external hard drive or a cloud-based service.
Ensure that backups are automated and frequent to minimize data loss in case of an attack.

Use Reliable Antivirus and Antimalware Software:
Install reputable antivirus and antimalware software on your computer and keep it up-to-date.
Enable real-time scanning and automatic updates to detect and block ransomware threats.

Keep Your Operating System and Software Updated:
Regularly update your operating system and all software, including browsers and plugins.
Many updates contain security patches that can protect your system from vulnerabilities exploited by ransomware.

Be Cautious with Email and Links:
Be skeptical of email attachments and links, especially from unknown or suspicious sources.
Avoid clicking on unexpected email attachments or links, as they may lead to ransomware infections.

Use Strong, Unique Passwords:
Create strong and unique passwords for your accounts and change them regularly.
Consider using a password manager to generate and store complex passwords securely.