Wazp Ransomware Will Lock Your Files

While conducting an analysis of malware samples, we came across a ransomware variant named Wazp, which is part of the Djvu family. This specific ransomware encrypts files and modifies their filenames by adding the ".wazp" extension. Additionally, Wazp leaves behind a ransom note file called "_readme.txt".

It's worth noting that ransomware from the Djvu family often gets distributed alongside other types of malware, such as RedLine or Vidar, which are notorious for their data-stealing capabilities. As an example of how Wazp renames files, it transforms "1.jpg" into "1.jpg.wazp", "2.png" into "2.png.wazp", and so on.

The ransom note, issued by the attackers, demands payment from the victims in exchange for the necessary decryption keys and software to restore their encrypted data. To establish communication, the note provides two email addresses: support@freshmail.top and datarestorehelp@airmail.cc.

Furthermore, the note emphasizes that the cost of the decryption tools will vary based on how quickly the victims respond. According to the ransom note, victims who reach out to the attackers within a 72-hour timeframe have the option to obtain the decryption tools for $480.

However, those who contact them after this timeframe will be required to pay $980. Moreover, the note suggests that victims can send a single encrypted file of lesser importance, which will be decrypted free of charge as a demonstration of the attackers' ability to decrypt files before considering the purchase of the decryption tools.

Wazp Ransom Note Asks for Initial Ransom of $490

The complete text of the Wazp ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-6Dm02j1lRa
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How is Ransomware Like Wazp Distributed Online?

The distribution of ransomware like Wazp can occur through various online channels and tactics. Here are some common methods used by attackers to distribute ransomware:

• Malicious Email Attachments: Attackers often send phishing emails that appear legitimate and contain malicious attachments. These attachments may be disguised as harmless files, such as documents, PDFs, or ZIP archives. When the recipient opens the attachment, the ransomware payload is executed, infecting the system.
• Infected Websites and Malvertising: Attackers can compromise legitimate websites or create malicious websites that host exploit kits. These exploit kits exploit vulnerabilities in the visitor's browser or plugins to deliver ransomware. Malvertising (malicious advertising) involves placing infected ads on legitimate websites, which can lead to drive-by downloads of ransomware when users click on the ads.
• Exploiting Software Vulnerabilities: Ransomware can be distributed by exploiting vulnerabilities in software applications, operating systems, or network protocols. Attackers take advantage of unpatched systems or outdated software that haven't received necessary security updates, allowing the ransomware to infiltrate the vulnerable systems.
• Remote Desktop Protocol (RDP) Attacks: Cybercriminals may target systems with poorly configured or weakly protected Remote Desktop Protocol connections. By gaining unauthorized access, they can deploy ransomware directly onto the compromised systems.
• Malicious Downloads from File-Sharing Networks: Attackers distribute ransomware by uploading infected files to file-sharing networks or torrent sites, masquerading as popular movies, software cracks, or other desirable downloads. Unsuspecting users who download and execute these files unknowingly install ransomware on their systems.