Qarj Ransomware is a New Djvu Clone

Our research team has identified Qarj, a form of ransomware that belongs to the Djvu ransomware family. Upon infecting a system, Qarj encrypts files and alters their filenames by appending the ".qarj" extension. The ransom message is stored in a file named "_readme.txt" and provides instructions for contacting the attackers to obtain file decryption.

Qarj alters filenames by adding ".qarj" to the end of each file name. For instance, "1.jpg" becomes "1.jpg.qarj," and "2.png" becomes "2.png.qarj." The Qarj ransomware was discovered by our team while analyzing malware samples submitted to VirusTotal. This ransomware may be distributed alongside Vidar or RedLine, which are information stealers.

The ransom note includes instructions for making contact and paying the ransom fee. The attackers can be reached through support@freshmail.top or datarestorehelp@airmail.cc. The ransom fee varies from $980 to $490, depending on how soon the victims contact the attackers, either before or after 72 hours.

The ransom note suggests that one encrypted file can be decrypted for free, provided that it does not contain valuable data. Victims may send an encrypted file to one of the email addresses provided before purchasing decryption tools.

Table of Contents

Qarj Asks for Nearly $1000 in Ransom

The full text of the Qarj ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-zUVSNg4KRZ
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can You Keep Your Files Safe From Ransomware Like Qarj?

Ransomware attacks like Qarj can cause significant damage and result in financial loss for individuals and businesses. However, there are several measures you can take to keep your files safe from such attacks:

Keep your software and operating system up-to-date: Regularly update your software and operating system to ensure that security vulnerabilities are patched.

Use reputable antivirus software: Install and use reputable antivirus software that is capable of detecting and blocking ransomware attacks.

Backup your files: Regularly backup your important files to an external hard drive or a cloud storage service. This way, even if your files are encrypted by ransomware, you can restore them from a backup.

Be cautious with email attachments: Avoid opening email attachments from unknown senders, as they may contain ransomware or other malicious software.