Wzer Ransomware Locks Victim Files

While examining new malware samples, our team came across the Wzer ransomware, which is linked to the Djvu family. When it infiltrates a computer, Wzer encrypts various files and adds the ".wzer" extension to their original names. For instance, a file named "1.jpg" is transformed into "1.jpg.wzer," while "2.png" changes to "2.png.wzer," and so on.

Beyond its primary function of encrypting files, Wzer generates a ransom note that appears as a text file called "_readme.txt." Additionally, the distribution of Wzer might involve collaboration with information-stealing malware like Vidar and RedLine.

The ransom note within the "_readme.txt" file stresses that file decryption relies on using specific decryption software and a unique key. The victims are instructed to establish contact with the attackers through provided email addresses (support@freshmail.top or datarestorehelp@airmail.cc) for further guidance.

Moreover, the ransom note presents two different amounts: $980 and $490, indicating that victims can potentially obtain the decryption tools at a reduced rate if they communicate with the attackers within a 72-hour window.

Wzer Ransom Note Asks for $490 in Ransom Payment

The full text of the Wzer ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-E3ktviSmlG
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How is Ransomware Like Wzer Distributed Online?

Ransomware like Wzer is typically distributed through various methods that exploit vulnerabilities in computer systems or capitalize on human behavior. Some common distribution methods include:

• Malicious Email Attachments: Cybercriminals often send out phishing emails containing malicious attachments, such as infected documents or executables. These attachments may be designed to look like legitimate files, and when the victim opens them, the ransomware is executed.
• Infected Software Installers: Cybercriminals may compromise legitimate software installers or create fake versions of popular software. When users download and install these infected files, the ransomware is secretly installed alongside.
• Malicious Links: Phishing emails or messages might contain links to websites that host the ransomware. Clicking on these links can lead to the automatic download and installation of the ransomware.
• Exploit Kits: Cybercriminals can utilize exploit kits, which are malicious software packages designed to exploit vulnerabilities in web browsers, plugins, or other software. When a user visits a compromised website, the exploit kit detects vulnerabilities and delivers the ransomware payload.
• Remote Desktop Protocol (RDP) Attacks: Attackers target systems with weak RDP credentials or known vulnerabilities. Once they gain remote access, they install the ransomware.
• Malvertising: Malicious advertisements on legitimate websites can lead users to malicious websites hosting the ransomware. Simply visiting the compromised site could trigger the download and installation of the ransomware.
• Peer-to-Peer Networks and Pirated Software: Illegitimate software downloads from peer-to-peer networks or cracked/pirated software versions can contain hidden ransomware payloads.
• Drive-By Downloads: Cybercriminals can use compromised websites to deliver malware to visitors' systems without any user interaction. Vulnerabilities in the browser or its plugins are exploited to initiate the download and execution of the ransomware.