Teza Ransomware Locks Victim Systems

In our examination of malicious software samples, we came across a type of ransomware called Teza. This ransomware encrypts files and modifies their names by appending the ".teza" extension. Moreover, Teza generates a ransom message in the form of a text file labeled "_readme.txt".

To demonstrate how Teza adjusts filenames, it changes names like "1.jpg" to "1.jpg.teza" and "2.png" to "2.png.teza". It's important to note that Teza is a variant of the Djvu ransomware group. Djvu ransomware is often distributed alongside data-stealing malware such as RedLine or Vidar.

The ransom message includes instructions from the malicious actors and provides two email addresses (support@freshmail.top and datarestorehelp@airmail.cc). It advises victims to get in touch with the hackers within 72 hours to avoid a higher ransom fee. The initial cost for decryption is $490, but failing to respond within the specified time frame increases the ransom to $980.

Additionally, the message emphasizes that recovering the encrypted files is impossible without obtaining the decryption software and a unique key from the attackers. Furthermore, the message offers a free decryption of one file, given that the file doesn't contain critical or valuable information.

Teza Ransom Note Follows Old Djvu Template

The complete text of the Teza ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-E4b0Td2MBH
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can Ransomware Like Teza Infect Your System?

Ransomware like Teza can infect your system through various methods, primarily relying on exploiting vulnerabilities, social engineering, and malicious attachments or links. Here are some common ways ransomware can infect your system:

Phishing Emails: Cybercriminals often send convincing-looking emails that contain malicious attachments or links. These emails might appear to be from a trusted source, such as a legitimate company or a friend, and they encourage you to click on a link or download an attachment. Once you interact with these elements, the ransomware payload can be executed on your system.

Malicious Websites and Downloads: Visiting compromised or malicious websites, especially those hosting illegal content or software cracks, can lead to the automatic download and execution of ransomware onto your system.

Exploit Kits: Exploit kits are toolkits that target software vulnerabilities on your computer. If your system isn't up-to-date with the latest security patches, ransomware can exploit these vulnerabilities to gain access and execute its payload.

Malvertising: Malicious advertisements, or malvertisements, can be found on legitimate websites and can deliver ransomware when clicked on. These ads can redirect you to malicious websites that exploit vulnerabilities in your system.

Drive-by Downloads: These occur when ransomware is automatically downloaded and executed when you visit a compromised website. You might not even notice that anything has happened until it's too late.

Social Engineering: Cybercriminals can trick users into manually downloading and running ransomware. This can involve deceptive tactics, such as posing as technical support personnel who instruct users to download a supposed software update that is, in fact, ransomware.

Malicious Attachments: Ransomware can be distributed through email attachments that appear legitimate but contain malicious code. Opening these attachments can trigger the ransomware payload.