Ttza Ransomware Encrypts Victim Systems

Ttza is a type of ransomware that encrypts files and adds the ".ttza" extension to the filenames of the affected files. It also creates a ransom note called "_readme.txt," which includes contact details and payment instructions. Ttza is part of the Djvu ransomware family and may be distributed alongside other malware like RedLine, Vidar, or similar data-stealing programs.

The discovery of Ttza occurred during an analysis of new filesamples. As an example of how Ttza changes filenames, it transforms "1.jpg" into "1.jpg.ttza" and "2.png" into "2.png.ttza," and so on.

According to the ransom note, the victim's files have been encrypted, and the only way to recover them is by obtaining decryption software and a unique decryption key. The initial cost for these decryption tools is $980, but if the victim contacts the attacker within 72 hours, they can receive a 50% discount, reducing the price to $490.

The note emphasizes that file recovery is impossible without paying the ransom. However, the attacker does mention an offer to decrypt one file for free. You can initiate contact with the threat actor using two provided email addresses: support@freshmail.top and datarestorehelp@airmail.cc.

Table of Contents

Ttza Ransom Note Increases Demands After 72 Hours

The full text of the Ttza ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-4vhLUot4Kz
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How is Ransomware Commonly Distributed Online?

Ransomware is commonly distributed online through various methods and attack vectors. Cybercriminals continuously adapt their tactics to increase the chances of infecting systems and extorting money from victims. Here are some common ways ransomware is distributed:

Phishing Emails: Phishing emails are one of the most common methods for distributing ransomware. Cybercriminals send emails that appear legitimate and often contain malicious attachments (e.g., infected documents, executables) or links to malicious websites. When victims open the attachments or click on the links, the ransomware is executed on their systems.
Malicious Attachments: Ransomware can be hidden within seemingly harmless email attachments such as Word documents, PDFs, or ZIP files. These attachments contain malicious scripts or macros that, when executed, download and execute the ransomware.
Drive-By Downloads: Cybercriminals can compromise legitimate websites and inject malicious code into them. When users visit these compromised sites, their devices may automatically download and execute ransomware without their knowledge or consent.
Exploiting Vulnerabilities: Ransomware can exploit vulnerabilities in operating systems, software, or devices. Cybercriminals often target systems that have not been patched or updated with the latest security fixes. Once a vulnerability is exploited, the ransomware is delivered and executed.
Malvertising: Malicious advertising, or malvertising, involves cybercriminals placing malicious ads on legitimate websites. When users click on these ads, they can be directed to websites hosting exploit kits that deliver ransomware to their devices.
Social Engineering: Cybercriminals may use social engineering techniques to trick users into downloading or executing ransomware. This can include fake software updates, fraudulent tech support calls, or deceptive pop-up messages.