Waqq Ransomware Will Hold Your Files Hostage

During our analysis of malware samples, we came across a new ransomware called Waqq. This ransomware focuses on encrypting files and adds the ".waqq" extension to the filenames of the encrypted files. Additionally, it creates a ransom note titled "_readme.txt."

For instance, Waqq alters filenames by renaming "1.jpg" to "1.jpg.waqq" and "2.png" to "2.png.waqq," following a similar pattern for other files. It is worth noting that Waqq is part of the Djvu ransomware family, and it may be distributed alongside other information stealers like RedLine, Vidar, and similar malware.

The ransom note left by the attackers provides two email addresses, support@freshmail.top and datarestorehelp@airmail.cc, instructing victims to contact them within 72 hours to prevent the ransom amount from increasing to $980, double the initial demand of $490.

Furthermore, the note emphasizes that decrypting the encrypted files is impossible without obtaining the decryption software and a unique key from the attackers. Additionally, it offers to decrypt a single file as a gesture of goodwill, as long as the file does not contain critical data.

Table of Contents

Waqq Ransom Note Promises Decryption of a Single File

The complete text of the ransom note generated by Waqq reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-6Dm02j1lRa
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can You Protect Your Data from Ransomware Like Waqq?

To protect your data from ransomware like Waqq, it is important to follow these preventive measures:

Backup Your Data: Regularly back up your important files to an offline or cloud storage solution. Ensure your backups are not directly accessible from your computer or network to prevent ransomware from infecting them.
Keep Software Updated: Maintain up-to-date software and operating systems on all your devices. Regularly apply security patches and updates to address vulnerabilities that ransomware can exploit.
Exercise Caution with Email: Be cautious when opening email attachments or clicking on links, especially from unknown or suspicious sources. Avoid opening attachments or clicking on links unless you are confident about their legitimacy.
Enable Macro Security: Disable macros in office productivity software (such as Microsoft Office) and enable macro security settings. This helps prevent malicious macros embedded in documents from executing and spreading ransomware.
Use Reliable Security Software: Install reputable antivirus and antimalware software on your devices. Keep the software up to date and perform regular scans to detect and remove any potential threats.