Rzml Ransomware Locks Victim Files

During our analysis of malware samples, we came across the Rzml ransomware, which belongs to the Djvu family. When a computer gets infected with Rzml, it encrypts files and appends the ".rzml" extension to their file names. For instance, "1.jpg" is transformed into "1.jpg.rzml," and "2.png" changes to "2.png.rzml."

In addition to encrypting files, Rzml also generates a ransom note in the form of a text file named "_readme.txt." Furthermore, the distribution of Rzml may include information-stealing malware like Vidar and RedLine.
The ransom note emphasizes that the decryption process depends exclusively on specific decryption software and a corresponding key. The note advises victims to make contact with the attackers using the provided email addresses (support@freshmail.top or datarestorehelp@airmail.cc) for further guidance.

Furthermore, the ransom note mentions two different amounts ($980 and $490), suggesting that victims may have the option to acquire the decryption tools at a reduced rate if they get in touch with the attackers within a 72-hour timeframe.

Rzml Ransom Note Asks for $490 in Payment

The complete text of the Rzml ransom note goes as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-RX6ODkr7XJ
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can You Protect Your Data from Ransomware Attacks?

Protecting your data from ransomware attacks is crucial in today's digital landscape. Ransomware attacks can be devastating, but there are several steps you can take to safeguard your data:

Regularly Back Up Your Data:
Create regular backups of your important files and data. Ensure these backups are stored offline or in a separate network segment, so they can't be accessed by ransomware if your system is compromised.

Use Reliable Backup Solutions:
Employ reputable backup solutions that provide versioning, so you can restore to a point before the ransomware infection occurred.

Keep Software Up to Date:
Regularly update your operating system, software applications, and antivirus/antimalware programs. Cybercriminals often exploit known vulnerabilities, so keeping your software patched is crucial.

Implement Strong Security Practices:
Use strong, unique passwords for all accounts and enable two-factor authentication (2FA) wherever possible.

Use Email Filtering:
Employ email filtering solutions to block or quarantine suspicious email attachments and links.

Limit User Privileges:
Restrict user privileges to the minimum necessary for their roles. Users should only have access to the files and systems they need to perform their tasks.