Wwza Ransomware Locks Victim Systems

During our analysis of malware samples, we came across the Wwza ransomware, which is a part of the Djvu ransomware family. When this ransomware infiltrates a computer, it encrypts data and appends the ".wwza" extension to file names. For instance, a file originally named "1.jpg" will be changed to "1.jpg.wwza," and "2.png" will become "2.png.wwza," and so on.

In addition to encrypting files, Wwza generates a ransom note in the form of a text document named "_readme.txt." The distribution of Wwza may also involve various other types of malware designed to steal information.

The ransom note emphasizes that decrypting the files relies entirely on specialized decryption software and a unique key. It instructs victims to establish contact with the attackers through the provided email addresses (support@freshmail.top or datarestorehelp@airmail.cc) to receive more detailed guidance.

Furthermore, within the ransom note, two monetary amounts ($980 and $490) are mentioned, suggesting that victims may be eligible for a discounted rate on the decryption tools if they initiate contact with the culprits within a 72-hour timeframe.

Table of Contents

Wwza Uses Standard Djvu Note Template

The full text of the Wwza ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-xoUXGr6cqT
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can Ransomware Like Wwza Infect Your Computer?

Ransomware like Wwza can infect your computer through various means, often relying on deceptive tactics and security vulnerabilities. Here are common ways ransomware can infiltrate your computer:

Malicious Email Attachments: Cybercriminals often distribute ransomware via phishing emails. They send emails with seemingly innocuous attachments, such as Word documents or PDFs, that contain malicious macros or scripts. When you open the attachment, it activates the ransomware.
Infected Email Links: Phishing emails may also contain links to malicious websites. Clicking on these links can lead to drive-by downloads or redirect you to a site that tricks you into downloading ransomware.
Malvertising: Ransomware can be spread through malicious online advertisements (malvertising). Clicking on these ads may trigger a drive-by download, installing ransomware on your system without your knowledge.
Software Vulnerabilities: Ransomware can exploit vulnerabilities in your operating system, software, or browser. This is why it's crucial to keep your software up to date with the latest security patches.
Compromised or Fake Software: Some ransomware is bundled with cracked or pirated software, or it masquerades as legitimate applications. Downloading and installing such software can lead to an infection.
Remote Desktop Protocol (RDP) Attacks: Attackers can gain access to your computer through weak or exposed RDP connections. Once inside, they can manually install ransomware.
Malicious Websites: Visiting compromised or malicious websites can expose your computer to drive-by downloads. Ensure you only visit reputable websites, and use browser security extensions when possible.
Social Engineering: Attackers may use social engineering tactics, such as fake tech support calls, to trick you into granting them access to your computer. Once inside, they can deploy ransomware.