Yytw Ransomware is Yet Another Djvu Variant

During our examination of malware specimens, we came across Yytw, a distinctive variation of ransomware with connections to the Djvu malware family. Yytw is designed to encrypt files, appending the ".yytw" extension to the end of each filename. Furthermore, as part of its modus operandi, the ransomware generates a ransom message presented as a text file titled "_readme.txt."

For instance, Yytw alters filenames by changing "1.jpg" to "1.jpg.yytw," and "2.png" to "2.png.yytw," demonstrating its methodology. A notable aspect to consider is that Yytw has the potential to be disseminated alongside malware designed for data theft, such as Vidar and RedLine. This combination amplifies its menace, putting users and their sensitive data in greater jeopardy.

Contained within the ransom note are explicit directives for initiating contact with the attackers, along with details regarding the cost of decryption. To acquire the decryption tools and associated key, victims are advised to engage in communication with the attackers via designated email addresses, which include support@freshmail.top and datarestorehelp@airmail.cc.

Within the ransom note, two distinct sums are presented as ransom demands—$980 and $490. This duality implies that victims possess an opportunity to secure the decryption resources at a discounted rate if they establish communication with the attackers within a window of 72 hours.

Yytw Ransom Note Asks for $490 in Ransom Payment

The complete text of the Yytw ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with
strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-xZJtZ8PDb2
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can You Protect Your Data from Ransomware Attacks?

Protecting your data from ransomware attacks requires a combination of proactive measures and best practices to minimize the risk of infection and ensure the ability to recover in case of an attack. Here are some steps you can take:

Regular Backups: Regularly back up your data to offline or secure cloud storage. Ensure your backups are not directly accessible from your main network to prevent them from being compromised during an attack.

Update Software: Keep your operating system, software, and applications up-to-date. Cybercriminals often exploit vulnerabilities in outdated software.

Use Antivirus and Antimalware Software: Install reputable security software that can detect and block ransomware threats.

Email Vigilance: Be cautious when opening email attachments or clicking on links, especially from unknown or suspicious senders. Verify the legitimacy of the sender and the content before taking any action.

Disable Macros: Disable macros in documents, as they can be used to deliver ransomware. Only enable macros if you are certain of the source.

Strong Passwords: Use strong, unique passwords for all your accounts and systems. Consider using a password manager to help you generate and manage complex passwords.

Multi-Factor Authentication (MFA): Enable MFA wherever possible to add an extra layer of security to your accounts.