Ptrz Ransomware Will Encrypt Most Files

While analyzing malware samples, we came across a ransomware variant named Ptrz. This ransomware is responsible for encrypting files and changing their names by adding the ".ptrz" extension. Additionally, Ptrz generates a ransom note, which can be found in a file named "_readme.txt."

Ptrz modifies file names in the following way: it converts a file like "1.jpg" to "1.jpg.ptrz," "2.png" to "2.png.ptrz," and so on. It's worth noting that Ptrz is linked to the Djvu ransomware family, and cybercriminals may distribute it alongside information-stealing malware.

The ransom note assures victims that they have the possibility to recover their files. It clarifies that all their essential files, including photos, databases, and documents, have been encrypted with a robust encryption method and a unique key. The sole method to regain access to these files is by purchasing a decryption tool and the corresponding unique key.

The note extends a limited guarantee by allowing victims to send one encrypted file for free decryption to demonstrate their capability to unlock the files. However, this offer is restricted to a single file that must not contain valuable information.

It outlines the cost of the private key and decryption software as $980. It also mentions a 50% discount if victims contact the cybercriminals within the initial 72 hours, lowering the price to $490. Victims are directed to contact the cybercriminals through email at support@freshmail.top, and an alternative contact email address, datarestorehelp@airmail.cc, is provided.

Table of Contents

Ptrz Ransom Note Demands $980

The full text of the Ptrz ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-dHFDYXqlkk
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can Ransomware Infect Your System?

Ransomware can infect your system through various means, and attackers are continually evolving their tactics. Here are some common methods through which ransomware can infiltrate your system:

Phishing Emails: This is one of the most common delivery methods. You may receive an email with a malicious attachment or a link that, when clicked, downloads ransomware onto your system. These emails often impersonate legitimate organizations or contain enticing subject lines to encourage you to open them.
Malicious Websites: Visiting compromised or malicious websites can lead to drive-by downloads, where ransomware is silently downloaded and executed on your system without your knowledge or consent. These websites often exploit software vulnerabilities in your browser or plugins.
Social Engineering: Attackers may use social engineering techniques to trick you into downloading and executing ransomware. For example, they may masquerade as tech support and convince you to install a fake security update that's actually ransomware.
Software Vulnerabilities: Ransomware can exploit vulnerabilities in your operating system, applications, or plugins. It's essential to keep your software up to date to patch these vulnerabilities.
Malicious Downloads: You might unintentionally download ransomware while trying to obtain pirated software, games, or other copyrighted content. Cybercriminals often use torrent sites and other illegal download sources to distribute malware.
RDP (Remote Desktop Protocol): If you have Remote Desktop enabled and weak or default credentials, attackers can gain access to your system and install ransomware. They may also use brute force attacks to guess your password.