Qeza Ransomware Locks Infected Systems
Qeza is a type of ransomware belonging to the Djvu family. Ransomware is a type of malicious software that encrypts files and demands payment in exchange for decryption. Alongside encrypting files, Qeza appends the extension ".qeza" to filenames and leaves a ransom note named "_README.txt".
When Qeza encrypts files, it renames them by adding ".qeza" to the original filename. For instance, "1.jpg" becomes "1.jpg.qeza" and "2.png" becomes "2.png.qeza". Being part of the Djvu family, Qeza may be distributed in conjunction with information stealers such as Vidar and RedLine.
The ransom note left by Qeza informs victims that their files have been encrypted and the only way to restore them is by purchasing a decryption tool and a unique key. It mentions that one file (without important data) can be decrypted free of charge. The note provides two contact email addresses: support@freshingmail.top and datarestorehelpyou@airmail.cc.
It specifies the decryption cost as $999, with a discounted rate of $499 if victims contact the threat actors within 72 hours. The note also asserts that data recovery is not possible without payment.
Qeza Ransom Note Demands $999
The full text of the Qeza ransom note reads as follows:
ATTENTION!
Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
Do not ask assistants from youtube and recovery data sites for help in recovering your data.
They can use your free decryption quota and scam you.
Our contact is emails in this text document only.You can get and look video overview decrypt tool:
Price of private key and decrypt software is $999.
Discount 50% available if you contact us first 72 hours, that's price for you is $499.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:
support@freshingmail.topReserve e-mail address to contact us:
datarestorehelpyou@airmail.ccYour personal ID:
How is Ransomware Spread Online?
Ransomware can spread online through various methods, including:
Phishing Emails: One of the most common methods is through phishing emails. Attackers send deceptive emails that appear legitimate, often with attachments or links that, when opened or clicked, download and execute the ransomware on the victim's system.
Malicious Links: Ransomware can be distributed through malicious links on websites, social media platforms, or messaging apps. Clicking on these links can trigger the download and installation of ransomware onto the victim's device.
Exploit Kits: Cybercriminals can leverage exploit kits, which are tools designed to identify vulnerabilities in software or operating systems. By exploiting these vulnerabilities, ransomware can be silently installed on a victim's computer without their knowledge.
Remote Desktop Protocol (RDP) Attacks: Attackers target devices with exposed or weakly secured RDP connections. They use brute-force techniques to gain unauthorized access to the system and deploy ransomware.
Malvertising: Malicious advertisements (malvertising) on legitimate websites can redirect users to websites hosting ransomware. Simply visiting a compromised website can trigger the download of ransomware onto the victim's computer.
Drive-by Downloads: This occurs when ransomware is automatically downloaded and installed on a victim's device without their consent while visiting a compromised website.
