Zput Ransomware Enctypts Victim Systems

While conducting our routine analysis of malware, our research team came across the Zput ransomware. This malicious software is a member of the Djvu ransomware family and is specifically designed to encrypt files, with the intention of extorting ransoms for the decryption of these files.

On our test system, this ransomware made alterations to the filenames of encrypted files by adding a ".zput" extension. In other words, a file originally named "1.jpg" would appear as "1.jpg.zput," "2.png" would become "2.png.zput," and so on. Subsequently, a ransom note labeled "_readme.txt" was deposited.

The ransom note conveys to the victim that their data has been locked through encryption. To restore normal access to the encrypted files, the victim is required to meet the demands of the attackers, which involves making a ransom payment in order to obtain the decryption key or software. The specified amount is 980 USD, but if the victim initiates contact within 72 hours, this amount is reduced by half to 490 USD. Before making the payment, the victim is allowed to test the decryption process on one file at no cost.

Zput Ransom Note Demands $490

The complete text of the Zput ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-cfHHerNTF6
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID: -

How is Ransomware Like Zput Propagated Online?

Ransomware like Zput is typically propagated online through various methods and techniques that take advantage of security vulnerabilities, user actions, and social engineering. Here are some common ways ransomware like Zput is distributed:

• Malicious Email Attachments: Cybercriminals often use phishing emails to distribute ransomware. They send seemingly legitimate emails with malicious attachments (e.g., Word documents, PDFs, or executable files) that, when opened, execute the ransomware on the victim's computer.
• Infected Email Links: Ransomware can also be spread through email links that lead to malicious websites. Clicking on such links can initiate a drive-by-download, where ransomware is automatically downloaded and installed on the victim's device.
• Malvertising: Cybercriminals may compromise legitimate ad networks to serve malicious ads on websites. Clicking on these ads can lead to ransomware infections. This is known as malvertising.
• Exploiting Software Vulnerabilities: Ransomware can take advantage of unpatched or outdated software vulnerabilities. Once a system is compromised, the malware can be delivered through exploit kits, which are automated tools used by cybercriminals to target these vulnerabilities.
• Drive-By Downloads: Visiting compromised or malicious websites can result in drive-by downloads, where ransomware is downloaded and executed without user consent. These websites may host exploit code that takes advantage of browser or software vulnerabilities.
• Software Piracy: Cracked or pirated software often contains ransomware. People who download and install such software from unverified sources risk infecting their systems with ransomware.
• Social Engineering: Cybercriminals use social engineering tactics to trick users into downloading or executing malicious files. This can include fake software updates, fake antivirus alerts, or claims of prize winnings that require downloading a file.