Z61yt Ransomware Uses Complex Extensions
There is a new strain of file-encrypting malware in the wild, called the Z61yt ransomware. The new variant belongs to the family of Hive ransomware clones.
The ransomware encrypts most popular file types it encounters on a victim system's drives, making the files unreadable. The encrypted file types include media, document, archive and database filetypes.
Once encryption completes, affected files receive an extremely long new extension, comprised of several long strings of random alphanumeric characters, split by dashes and underscores. The long-form extension ends with the ".Z61yt" string, rounding out the new filename.
The ransom note is dropped inside a plain-text file with the name "1uZ5_HOW_TO_DECRYPT.txt". The instructions inside include going on a Tor page and using the login credentials provided in the ransom note in order to pay the ransom.
The full text of the ransom note is as follows:
Your network has been breached and all data were encrypted.
Personal data, financial reports and important documents are ready to disclose.
To decrypt all the data and to prevent exfiltrated files to be disclosed at
hxxp://[address string].onion/
you will need to purchase our decryption software.
Please contact our sales department at:
hxxp://[address string].onion/
Login:
Password:
To get an access to .onion websites download and install Tor Browser at:
hxxps://www.torproject.org/ (Tor Browser is not related to us)
Follow the guidelines below to avoid losing your data:
- Do not modify, rename or delete *.key.z61yt files. Your data will be
undecryptable.
- Do not modify or rename encrypted files. You will lose them.
- Do not report to the Police, FBI, etc. They don't care about your business.
They simply won't allow you to pay. As a result you will lose everything.
- Do not hire a recovery company. They can't decrypt without the key.
They also don't care about your business. They believe that they are
good negotiators, but it is not. They usually fail. So speak for yourself.
- Do not reject to purchase. Exfiltrated files will be publicly disclosed.
