Pthh Ransomware Encrypts Many File Types

Upon conducting a comprehensive examination of new file samples, we have detected the Pthh ransomware, which belongs to the Djvu family. This malicious software is responsible for encrypting data and appending the ".pthh" extension to the affected files. Once the encryption process is completed, Pthh leaves a ransom note behind, denoted by the filename "_readme.txt."

Pthh adheres to a specific pattern when modifying the filenames of the files it encrypts. For example, it transforms "1.jpg" into "1.jpg.pthh" and "2.png" into "2.png.pthh." Given its affiliation with the Djvu family, Pthh has the potential to be distributed alongside information-stealing malware.

The ransom note issued by the Pthh ransomware contains two email addresses, namely support@freshmail.top and datarestorehelp@airmail.cc. It provides victims with the opportunity to obtain decryption software and the requisite decryption key. The initial cost for availing these decryption services is fixed at $980.

However, if victims make contact with the threat actors within a 72-hour timeframe, they can acquire the decryption tools at a reduced rate of $490. Additionally, the ransom note extends an offer for victims to submit a single encrypted file for free decryption, with the condition that the provided file should not contain any valuable data.

Table of Contents

Pthh Ransom Note Copies Usual Djvu Template

The full text of the Pthh ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-dHFDYXqlkk
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can You Protect Your Valuable Data from Ransomware Similar to Pthh?

Protecting your valuable data from ransomware like Pthh requires a combination of preventive measures and proactive cybersecurity practices. Here are several strategies to help safeguard your data:

Backup Your Data:
Regularly back up your data to offline or cloud storage. Ensure the backups are not directly accessible from your network to prevent them from being encrypted by ransomware.

Keep Software Updated:
Maintain up-to-date operating systems, software, and antivirus programs. Cybercriminals often target known vulnerabilities in outdated software.

Use Reliable Security Software:
Install reputable antivirus and anti-malware software to help detect and block ransomware threats. Keep these programs up to date.

Employ Email Security:
Be cautious when opening email attachments or clicking on links. Use email filtering software to identify and block phishing attempts.

Enable Firewall and Intrusion Detection:
Enable firewalls and intrusion detection systems to monitor network traffic for suspicious activities.

User Training and Awareness:
Educate yourself about the dangers of phishing, suspicious websites, and downloading files from untrusted sources.