Zpas Ransomware Will Lock Your Files

During our examination of new malware samples, our research team came across another Djvu ransomware known as Zpas. This type of malware is specifically designed to encrypt data and then demand payment in exchange for the decryption key.

After we ran a Zpas sample on our test system, it proceeded to encrypt files and add a ".zpas" extension to their filenames. For instance, a file originally named "1.jpg" would be transformed into "1.jpg.zpas," and "2.png" would become "2.png.zpas," and so on. Subsequently, a ransom note labeled "_readme.txt" was generated.

The message in the Zpas ransom note attempts to reassure the victim that their inaccessible databases, documents, images, and other crucial files can be restored. However, this restoration process requires the acquisition of the decryption tool and associated key, both of which come at a cost.

Before making any payments to the attackers, the victim has the option to test the decryption process on a single file that doesn't contain sensitive information. The price for the recovery tools is set at $980, but if the victim establishes contact with the cybercriminals within 72 hours, the sum will be reduced by 50% to $490.

Zpas Ransom Note Demands $980

The full text of the Zpas ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-cfHHerNTF6
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can You Protect Your Data Against Ransomware?

Protecting your data against ransomware is crucial to prevent data loss and avoid falling victim to extortion. Here are some effective measures to guard your data against ransomware:

Backup Regularly:
Maintain regular, automated backups of your data. Ensure backups are stored offline or on a separate network where ransomware can't reach them.

Update Software:
Keep your operating system, software, and antivirus programs up to date. Vulnerabilities in outdated software can be exploited by ransomware.

Use Reliable Security Software:
Install reputable antivirus and anti-malware software. It can help detect and block ransomware before it can encrypt your data.

Email and Web Security:
Be cautious when opening email attachments or clicking on links, especially from unknown sources. Use email and web security tools to filter out malicious content.

Software Restriction Policies:
Implement software restriction policies or application whitelisting to only allow authorized programs to run.