Poaz Ransomware Scrambles Files

During our analysis of malicious file samples, we came across Poaz, a type of ransomware belonging to the Djvu family. Poaz uses file encryption to prevent access to files and alters their names by adding the ".poaz" extension. Furthermore, it generates a ransom note, a text file called "_readme.txt".

To illustrate how Poaz modifies file names, it transforms "1.jpg" into "1.jpg.poaz," "2.png" into "2.png.poaz," and so on. It's worth noting that Poaz might be distributed alongside information stealers like Vidar and RedLine.

The ransom note attempts to reassure victims by offering them a chance to recover their files. It claims that a broad range of files, including pictures, databases, documents, and other crucial data, have been encrypted using a robust encryption method and a unique key.

According to the ransom note, the only way to restore access to the encrypted files is by purchasing a decryption tool and the corresponding unique key. The cost for this is set at $980.

However, if victims contact the attackers within the first 72 hours, they are eligible for a 50% discount, reducing the price to $490. To initiate communication, the ransom note provides two email addresses: support@freshmail.top and datarestorehelp@airmail.cc.

Poaz Ransom Note Demands $980 for Decrypter

The full text of the Poaz ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-MDnNtxiPM0
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can Ransomware Like Poaz Enter Your System?

Ransomware like Poaz can enter your system through various means, primarily exploiting security vulnerabilities and human behavior. Some common methods include:

• Phishing Emails: The most common method involves sending malicious emails that appear legitimate, tricking users into clicking on malicious links or downloading infected attachments. Once the user interacts with the email, the ransomware payload is delivered to the system.
• Malicious Websites: Visiting compromised or malicious websites can lead to drive-by downloads, where the ransomware is automatically downloaded and executed without the user's knowledge or consent.
• Exploiting Software Vulnerabilities: Ransomware can exploit known vulnerabilities in software or operating systems to gain unauthorized access to a system. It's crucial to keep all software and applications up to date with the latest security patches.
• Malvertising: Attackers may use malicious advertisements (malvertising) on legitimate websites to deliver ransomware. Clicking on these ads can trigger the download and execution of the ransomware.
• Infected Removable Media: Ransomware can spread through infected USB drives or external storage devices that are connected to the system.
• Software or File Downloads: Downloading pirated software, cracked applications, or files from untrusted sources can expose your system to ransomware attacks.
• Remote Desktop Protocol (RDP) Vulnerabilities: Cybercriminals can exploit weak or default RDP credentials to gain access to systems and deploy ransomware.
• Social Engineering: Ransomware operators may use social engineering techniques to manipulate users into willingly running or downloading malicious files or applications.