Zouu Ransomware Joins Host of Djvu Variants

When analyzing the malicious software known as Zouu, we discovered that it is a type of ransomware. It encrypts files and adds the ".zouu" extension to their filenames. Additionally, Zouu creates a "_readme.txt" file with instructions for victims on how to proceed. For example, if a file was named "1.jpg", it would be renamed to "1.jpg.zouu".

We also found out that Zouu belongs to the Djvu ransomware family, which is often distributed alongside other malicious programs such as Vidar and RedLine. The ransom note associated with Zouu demands payment of $490 within 72 hours in order to receive decryption tools and a unique key; otherwise, the price increases to $980. Threat actors behind this ransomware can be contacted via two email addresses: support@freshmail.top and datarestorehelp@airmail.cc. Victims are also given an option of sending one file for free decryption; however, this file should not contain any important data.

In conclusion, Zouu is a type of ransomware belonging to the Djvu family which encrypts files and appends the ".zouu" extension to filenames. It also creates a ransom note with instructions on how to contact the threat actors and pay the ransom. Victims are given an option of sending one file for free decryption, but it should not contain any important data.

The full ransom note used by Zouu reads as follows:

ATTENTION!

Don't worry, you can return all your files!

All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.

The only method of recovering files is to purchase decrypt tool and unique key for you.

This software will decrypt all your encrypted files.

What guarantees you have?

You can send one of your encrypted file from your PC and we decrypt it for free.

But we can decrypt only 1 file for free. File must not contain valuable information.

You can get and look video overview decrypt tool:

hxpps://we.tl/t-N3pXlaPXFm

Price of private key and decrypt software is $980.

Discount 50% available if you contact us first 72 hours, that's price for you is $490.

Please note that you'll never restore your data without payment.

Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:

support@freshmail.top

Reserve e-mail address to contact us:

datarestorehelp@airmail.cc

Your personal ID:

To prevent ransomware from getting on your computer, it is important to practice good cyber hygiene. This includes regularly updating your operating system and software, using strong passwords, avoiding suspicious links and emails, and installing a reliable antivirus program. Additionally, you should back up your data regularly so that if you are infected with ransomware, you can restore your files from the backup. It is also recommended to disable macros in Microsoft Office applications as they can be used to deliver malicious payloads. Finally, it is important to be aware of phishing scams and other social engineering techniques used by cybercriminals to gain access to your system.