Werz Ransomware Will Encrypt Your Drives

ransomware

During our analysis of new malware samples, we came across a variant of the Djvu ransomware family called Werz. This particular ransomware encrypts files and alters their original filenames by adding the ".werz" extension. For instance, files that were originally named "1.jpg" would be renamed as "1.jpg.werz", "2.werz" as "2.png.werz", and so on.

Moreover, it leaves a ransom note behind in the form of a text file named "_readme.txt". It is important to note that the Werz ransomware may be distributed alongside other forms of malware. The ransom note attempts to reassure victims that their data can be restored and emphasizes that the only solution is to purchase decryption software along with a unique key. Additionally, the note offers to decrypt one file for free as a demonstration if it doesn't contain valuable information.

Furthermore, there is a time-limited discount available for victims who contact the threat actors within the initial 72 hours. The cost of the private key and decryption software is $980, but an expedited price of $490 is offered for prompt action.

To facilitate the process of acquiring the decryption tools, the ransom note provides two email addresses: support@freshmail.top and datarestorehelp@airmail.cc.

Werz Ransom Note Asks for $490 in Initial Ransom

The full text of the ransom note goes as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important
are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-3q8YguI9qh
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can Ransomware Like Werz Get on Your System?

There are several common ways through which ransomware like Werz can infiltrate your system:

  • Malicious email attachments: Ransomware can often be delivered through email attachments that appear legitimate, such as PDFs, Word documents, or ZIP files. Opening these attachments can trigger the execution of the ransomware, infecting your system.
  • Phishing emails and malicious links: Cybercriminals may send phishing emails impersonating trusted entities, enticing you to click on a malicious link. These links can lead to websites hosting the ransomware, initiating the download and installation process.
  • Exploit kits: Ransomware can exploit vulnerabilities in software or operating systems. By visiting compromised or malicious websites, the exploit kits can detect and exploit these weaknesses, allowing the ransomware to gain unauthorized access to your system.
  • Malicious downloads: Ransomware can be disguised as seemingly legitimate software or files available for download on the internet. Downloading and executing such files can introduce the ransomware into your system.
  • Malvertising: Cybercriminals can inject malicious code into legitimate online advertisements. When you click on these ads, you may unknowingly trigger the download and installation of ransomware onto your system.
May 31, 2023
Loading...

Cyclonis Backup Details & Terms

The Free Basic Cyclonis Backup plan gives you 2 GB of cloud storage space with full functionality! No credit card required. Need more storage space? Purchase a larger Cyclonis Backup plan today! To learn more about our policies and pricing, see Terms of Service, Privacy Policy, Discount Terms and Purchase Page. If you wish to uninstall the app, please visit the Uninstallation Instructions page.

Cyclonis Password Manager Details & Terms

FREE Trial: 30-Day One-Time Offer! No credit card required for Free Trial. Full functionality for the length of the Free Trial. (Full functionality after Free Trial requires subscription purchase.) To learn more about our policies and pricing, see EULA, Privacy Policy, Discount Terms and Purchase Page. If you wish to uninstall the app, please visit the Uninstallation Instructions page.