Mzlq ransomware: what it is and how to remove it

From our report of May 2020 · not reviewed since

More from our earlier report on Mzlq ransomware

• If your computer is crashing, lagging and returning errors after malware termination, repair Windows system with the help of

From our report of May 2020 · not reviewed since

Mzlq ransomware - a file locking malware that aims to extort money by locking all personal files on the system

Mzlq ransomware is a malicious program that might access your PC and lock all personal files on it, including pictures, music, videos, documents, databases, etc. Belonging to the most prominent crypto-malware family Djvu, it was first spotted in mid-May, 2020, attacking users all over the world via software cracks.

Once installed, the ransomware will append .mzlq extension to each of the files with the help of the RSA encryption algorithm, preventing user access.

To recover data, victims need to acquire a unique key that is stored on cybercriminals' servers. However, the attackers behind Mzlq virus are not willing to give it away for free, and blackmail users into paying ransom instead.

Inside a ransom note, titled _readme.txt, which can be found on the desktop and other places on the computer, crooks specifically mention that victims should contact them via helpmanager@mail.ch or restoremanager@firemail.cc if they want to acquire the decryptor. Security experts discourage users from paying and instead recommend using alternative methods for data recovery after Mzlq ransomware removal.

Djvu ransomware is one of the most prominent and successful crypto-malware families in the wild. Even though it is primarily using one attack vector for its propagation (pirated software installers and software cracks), Mzlq ransomware authors already released over 220 different versions, including Mpal, Qewe, Lezp, Lalo, and many others.

Since the family is huge, it obtains much attention from the security community and industry experts. Prior to August 2019, the malware used a weaker encryption method, which allowed security firm Emsisoft to release a decryption service that would allow users to regain data for free.

However, all the versions released past that date are no longer decryptable, although Emsisoft provided another tool (a successor for STOPDecrypter), that would help victims whose data was locked with an offline ID.

Nevertheless, one victim of Mzlq ransomware has to first pay the attackers the ransom to retrieve the offline key first in order for it to work for other users infected with the same malware version. Thus, you should not rush to pay the virus authors, as there is still a chance that your files where locked with an offline ID.

If you were hit by Mzlq ransomware, it is highly likely to happen due to a download from a pirated software distribution website. Quite often, the attackers insect malicious versions of illegal software or cracks, so users click on the executable without thinking that it is malicious.

Once inside the system, Mzlq file virus does not immediately locks data. Instead, it performs a series of changes to the Windows machines. For example:

Once the preparations are complete, Mzlq ransomware will begin to scan the system for files to encrypt. Just as many other data-locking viruses, it targets the most common file types, such as .jpg, .rar, .mp4, .gif, .doc, .xls, .txt, and many others. During the encryption process, users will be shown a fake Windows update screen so that they would not stop it before all data is locked.

At the end of data locking process, users are also presented with the _readme.txt ransom note which reads the following:

As evident, Mzlq ransomware authors are trying to convince users to pay the ransom and also offer a 50% discount if the payment is transferred within the first 72 hours of the infection. They also say that they can perform test decryption for a selected file for free.

However, these are mere tricks to create a false sense of security among victims. Keep in mind that trusting cybercriminals is not something that you should do - they might take your money and never send you the Mzlq ransomware decryption tool.

Instead, backup all the encrypted data first and then remove Mzlq ransomware from your system. The best way to do it is by employing a reputable anti-malware software, such as or for the process. Once complete, you can then proceed with alternative data recovery methods listed below.

If you decide to pay the ransom despite the risks, do not forget to contact Emsisoft researchers that could then provide help to other victims.

• the malware inserts the additional module into the web browsers to steal sensitive information as long as it is present on the machine;
• modifies Windows hosts file located in C:\Windows\System32\drivers\etc\ - this prevents users from visiting security-related websites and forums where they could seek help with malware removal and data recovery options;
• creates a variety of entries in the %AppData% and %User% folders, where the main executable is also placed;
• opens and modifies Windows registry keys in order to launch itself with each Windows launch;
• creates new and terminates some built-in processes, etc.

From our report of May 2020 · not reviewed since

Avoid software cracks like a plague

While in some cases, users choose to underestimate precautionary measures against malware infections, others are simply unaware of dangers that can be encountered online.

Regardless of the reason, hundreds of users are infected with ransomware each day, and many of them lose access to their files forever. This is the main reason why ransomware is so devastating and is also treated as a data breach as of recently when it hits a business or organization.

However, Djvu operates a scheme which mainly targets private users, so illegal websites that distribute pirated software is a perfect spot for malware propagation.

Pirated software installers and cracks are often used to bypass the registration process of the app to acquire its full features for free. While this activity is illegal and might result in fines from authorities, users are still keen on pirating programs, video games, and other software.

While some software installers can be scanned for malware with security software prior to the installation, software cracks are tools that cannot be properly checked, since, by design, they exist to break something within the program's code.

As a result, most anti-malware applications will flag it as malicious, regardless if it actually is and will result in ransomware or other malware infection. Therefore, stay away from software cracks, they are extremely dangerous, as they are often boobytrapped with malware.

You should also equip the computer with comprehensive security software, apply the most recent software updates immediately, create safe passwords (and never reuse them!), and regularly backup your data in case ransomware does manage to break into your machine.

From our report of May 2020 · not reviewed since

Mzlq ransomware removal process

Before you remove Mzlq ransomware, there are a few things that you need to take care of.

Once done, you will be able to access all the security-related websites once again without restrictions, as a new hosts file will be created by Windows automatically. Additionally, you should backup all the encrypted data before the Mzlq ransomware removal process, as it might permanently damage the already encrypted files.

There are many options available, and most of them recognize malware under the following names, according to Virus Total:

Overall, the detection rate of Mzlq ransomware is currently relatively low, which is pretty common to the newly-released malware samples. Also, most of the detections are performed using generic or heuristic analysis techniques - this highlights the importance of next-gen anti-malware applications.

[GI=method-1]To access Safe Mode with Networking, perform the following actions:

[GI=method-2]This method can also be used to eliminate the malware from the PC:

This application might help you bring back at least some of the encrypted files (the probability declines the longer you use your PC after the ransomware infection).

Use the built-in Windows Previous Versions feature

If you used System Restore before the attack occurred, you might be able to recover some some files one-by-one.

ShadowExplorer might be the answer

If Mzlq ransomware failed to delete Shadow Volume Copies, ShadowExplorer should be able to help you.

Make use of Emsisoft decryptor

Upon release, none of the Djvu versions are decryptable. Emsisoft decryptor can only work once one of the victims (whose files were locked with an offline ID), pay the ransomware and retrieve the key, later providing it to the security researchers. Thus, it might not work straight away (if ever).

• A Variant Of Win32/GenKryptik.EKKD
• W32.Trojan.Gen
• Trojan.Multi.Generic.4!c
• Mal/Generic-S
• Win32.Trojan-Ransom.STOP.XQ922Z
• Win32:DropperX-gen , etc.