Djvu Variant Kolz Ransomware Incentivizes Ransom Payment With Discounts

Since it was spotted in 2018, Djvu/STOP ransomware has strained to over 240 variants, becoming one of the most prominent ransomware families. Now, another member of the ever-growing family was recently detected. Dubbed Kolz, after the extension it uses, the ransomware is a high-severity level threat, designed to corrupt data and extort ransoms.

What is Kolz Ransomware

Kolz is a typical representative of the Djvu ransomware family. Following successful infiltration, it launches a scan that detects all user-generated files. The threat is after any file that might contain valuable information, including spreadsheets, databases, pictures, archives, and videos.

Kolz will use strong encryption algorithms to lock the files and prevent the user from accessing them.

All files encrypted by Kolz are easily recognizable as the ransomware appends the ".kolz" extension to them. For example, a file named "documents.rar" will be renamed to "documents.rar.kols."

Additionally, the ransomware will drop a ransom note named "_readme.txt" which contains brief information about the ransomware, as well as outlines the ransom demands.

Ransom demands

Kolz's operators promise a decryption key and software in exchange for $980. However, they offer a 50% discount to the victims who establish communication within 72 hours after encryption.

Victims are instructed to contact the criminals via email. The messages should be addressed either to helpmanager@mail.ch or restoremanager@airmail.cc.

Ransom Note Text: 

As proof of their abilities to decrypt data, the criminals offer free decryption of one file. However, their offer has one limiting condition. The victims can decrypt only files that don't contain valuable information, such as large Excel files and databases.

Decryption

As Kolz is a newly-found threat, its code is not analyzed yet and third-party decryption is not available. However, experts recommend against involving the ransomware operators. These criminals are experienced manipulators who know how to trick their victims into unwanted action.

Victims should be aware that by paying the ransom, they finance crime and encourage the criminals to continue their malicious business.

Backups stored on cloud and external storage can be used for file recovery. However, victims are advised to remove Kolz before they attempt any data-recovery operations. Otherwise, the ransomware will corrupt their newly-recovered files.

Distribution

The old but gold spam emails are the preferred distribution method of the Djvu family. Criminals use various popular topics and social engineering tricks to reach a broad spectrum of potential victims.

Ransomware operators often use a technique called "spoofing" to make their emails appear as if they are coming from legitimate sources. Usually, they impersonate well-known and trusted organizations and companies, such as shipping companies, banks, and government institutions. Kolz ransomware infects a device when an unprepared user downloads a malicious attachment or follows a weaponized link.

Trojans could also deliver Kolz ransomware as a second-stage malware. Although this method is usually used for targeted attacks, the trojan infection should not be underestimated as it can quickly evolve into a ransomware infection.