Yzaq Ransomware Locks Systems

During our examination of malicious file samples, we encountered Yzaq, a form of ransomware that belongs to the Djvu family. Yzaq employs file encryption to block access to files and changes their names by appending the ".Yzaq" extension. Additionally, it generates a ransom message in the form of a text file named "_readme.txt."

To illustrate how Yzaq alters file names, it transforms "1.jpg" into "1.jpg.Yzaq," "2.png" into "2.png.Yzaq," and so forth. It's important to note that Yzaq might be distributed alongside information-stealing malware such as Vidar and RedLine.

The ransom message aims to provide reassurance to victims by offering them a chance to recover their files. It asserts that a wide range of files, including images, databases, documents, and other critical data, have been encrypted using a strong encryption method and a unique key.

According to the ransom message, the sole way to regain access to the scrambled files is by purchasing a decryption tool along with the corresponding unique key. The cost for this service is set at $980.

However, if victims reach out to the perpetrators within the initial 72 hours, they qualify for a 50% discount of sorts, dropping the price to $490. The ransom message provides two email addresses to facilitate communication.

Table of Contents

Yzaq Ransom Note Demands $980

The full text of the note generated by Yzaq reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-WbgTMF1Jmw
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
restorealldata@firemail.cc

Reserve e-mail address to contact us:
gorentos@bitmessage.ch

Our Telegram account:
@datarestore

Your personal ID:

How Can Ransomware Like Yzaq Infiltrate Your System?

Ransomware, including Yzaq, can infiltrate your system through various methods and vulnerabilities. Here are some common ways ransomware can enter your system:

Phishing Emails: Phishing emails are a prevalent method for ransomware delivery. You might receive an email with a malicious attachment or a link that, when clicked, downloads the ransomware onto your system. These emails are often designed to look like they come from trusted sources or impersonate legitimate organizations.
Malicious Downloads: Ransomware can be bundled with seemingly innocent downloads, such as software cracks, keygens, or pirated software. When you download and execute these files, the ransomware is also installed on your system.
Exploiting Software Vulnerabilities: Ransomware can exploit known software vulnerabilities in your operating system or applications. This is why it's crucial to keep your software and operating system up to date with the latest security patches.
Drive-by Downloads: Visiting compromised or malicious websites can lead to drive-by downloads, where ransomware is silently installed on your system without your knowledge or consent.
Malicious Ads (Malvertising): Ransomware can be delivered through malicious online advertisements. Clicking on an infected ad can trigger a download and installation of ransomware.