Ppvt Ransomware is Based on Djvu Ransomware Code
While analyzing recent malware samples, we came across a ransomware variant named Ppvt. This particular ransomware is responsible for encrypting files and modifying their file names by adding the ".Ppvt" extension. Furthermore, Ppvt generates a ransom note enclosed within a file named "_readme.txt."
Ppvt follows a specific file renaming pattern, for example, it changes "1.jpg" to "1.jpg.Ppvt" and "2.png" to "2.png.Ppvt," and so on. It's worth noting that Ppvt is part of the Djvu ransomware family, and malicious actors might distribute it alongside data-stealing malware such as RedLine or Vidar.
The ransom note offers reassurance to victims that their files can be restored. It explains that their critical files, which include images, databases, and documents, have been encrypted using a robust method. The only means to regain access to these files is by obtaining a decryption tool and the corresponding unique key.
The note specifies the cost of the private key and decryption software as $980. It underscores a 50% discount for victims who reach out to the cybercriminals within the initial 72 hours, reducing the price to $490. Victims are instructed to contact the cybercriminals via email using the two provided email addresses in the ransom note.
Ppvt Ransom Note in Full
The complete text of the Ppvt ransom note reads as follows:
ATTENTION!
Don't worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-WbgTMF1Jmw
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:
restorealldata@firemail.ccReserve e-mail address to contact us:
gorentos@bitmessage.chOur Telegram account:
@datarestoreYour personal ID: -
How Can You Protect Your Data From Ransomware Attacks?
Protecting your data from ransomware attacks is crucial to prevent potential loss and avoid falling victim to cybercriminals. Here are some effective measures to safeguard your data:
Regular Backups:
Create regular backups of your data, including documents, photos, and important files. Store backups offline or in a separate, isolated network to prevent ransomware from reaching them.
Use Antivirus and Anti-Malware Software:
Install reputable antivirus and anti-malware software to detect and block ransomware before it can infect your system. Keep these programs up to date.
Enable Firewall Protection:
Activate a firewall on your computer and network to filter out malicious traffic and block unauthorized access.
Keep Software Updated:
Maintain your operating system, software, and applications with the latest security updates and patches. Ransomware often exploits known vulnerabilities.
Email Safety:
Be cautious with email attachments and links. Avoid opening attachments or clicking on links from unknown or suspicious sources. Use email filtering to help identify potentially harmful emails.
Download Safely:
Only download software and files from trusted sources. Avoid peer-to-peer (P2P) networks and unverified websites.
Use Strong, Unique Passwords:
Employ strong, unique passwords for your accounts. Consider using a password manager to assist in creating and storing complex passwords.
