ZAPS Ransomware
The latest STOP/Djvu variant that has been caught in the wild is the ZAPS Ransomware. The threat exhibits largely the same behavior and capabilities as the rest of the variants from this family. Its most distinguishing characteristic is the '.zaps' extension that it uses to mark all encrypted files. The lack of improvements in no way translates to reduced capacity to cause destruction, though.
Computers infected with the ZAPS Ransomware will be subjected to an encryption process employing an uncrackable cryptographic algorithm. All files from the targeted file types will then be locked and will no longer be accessible. Upon completing the process, the ZAPS Ransomware will generate a text file named '_readme.txt' carrying a ransom note with instructions for the victim.
Ransom Note's Overview
When the victims open the ransom-bearing message, they will find that ZAPS uses a virtually identical copy of the instructions typically associated with STOP/Djvu threats. The malware states that recovery of the encrypted data will only be possible after paying a ransom for the decryption key and software tool possessed by the hackers. The exact sum demanded by the cybercriminals is $980 but the amount can be reduced by 50%. The only requirement is for the affected users to contact the hackers in the first 72 hours after the ransomware attack. As part of their messages, victims are allowed to attach a single locked file. If the file doesn't contain any valuable information, it will supposedly be unlocked and returned for free.
The full text of ZAPS Ransomware's note is:
'ATTENTION!
Don’t worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-fhnNOAYC8Z
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don’t get answer more than 6 hours.To get this software you need write on our e-mail:
manager@mailtemp.chReserve e-mail address to contact us:
helpmanager@airmail.cc'
