Zorn virus: what is known so far?
Zorn adds its own .ZORN extension to every file’s name. For instance, a file entitled “photo.jpg” will be altered to “photo.jpg.ZORN”. In the same manner, the Excel file with the name “table.xlsx” will be renamed to “table.xlsx.ZORN”, and so forth.
YOUR COMPANY IS HACKED AND COMPROMISED Your network was ATTACKED, your computers and servers were LOCKED, Your private data was DOWNLOADED: - Contracts - Customers data - Finance - HR - Databases - And more other... If you do not contract us in the next 3 DAYS we will begin DATA publication. We will post information about hacking of your company on public You can find full details in the file RESTORE_FILES_INFO
In each directory containing the encrypted files, a RESTORE_FILES_INFO.txt text file will be created. It is a ransom money memo. It contains information on the ways of paying the ransom and some other remarks. The ransom note most probably contains instructions on how to buy the decryption tool from the ransomware developers. That is basically the scheme of the crime.
| Name | Zorn Virus |
| Extension | .ZORN |
| Ransomware note | RESTORE_FILES_INFO.txt |
| Detection1 | MSIL/Spy.Agent.DSV, TrojanSpy:Win32/Delgent, Trojan.Ransom.Magniber |
| Symptoms | Your files (photos, videos, documents) have a .ZORN extension and you can’t open them. |
| Fix Tool | See If Your System Has Been Affected by Zorn virus |
The RESTORE_FILES_INFO.txt document accompanying the Zorn ransomware states the following:
------------------
| What happened? |
------------------
Your network was ATTACKED, your computers and servers were LOCKED,
Your private data was DOWNLOADED:
- Contracts
- Customers data
- Finance
- HR
- Databases
- And more other...
----------------------
| What does it mean? |
----------------------
It means that soon mass media, your partners and clients WILL KNOW about your PROBLEM.
--------------------------
| How it can be avoided? |
--------------------------
In order to avoid this issue,
you are to COME IN TOUCH WITH US no later than within 3 DAYS and conclude the data recovery and breach fixing AGREEMENT.
-------------------------------------------
| What if I do not contact you in 3 days? |
-------------------------------------------
If you do not contact us in the next 3 DAYS we will begin DATA publication.
We will post information about hacking of your company on public
ALL YOUR CLIENTS WILL KNOW ABOUT THE INCIDENT!!!
Think very well of the consequences.
You can spare this little money and subsequently lose much more.
-----------------------------
| I can handle it by myself |
-----------------------------
It is your RIGHT, but in this case all your data will be published for public USAGE.
-------------------------------
| I do not fear your threats! |
-------------------------------
That is not the threat, but the algorithm of our actions.
If you have hundreds of millions of UNWANTED dollars, there is nothing to FEAR for you.
That is the EXACT AMOUNT of money you will spend for recovery and payouts because of PUBLICATION.
You are exposing yourself to huge penalties with lawsuits and government if we both don\'t find an agreement.
We have seen it before cases with multi million costs in fines and lawsuits,
not to mention the company reputation and losing clients trust and the medias calling non-stop for answers.
--------------------------
| You have convinced me! |
--------------------------
Then you need to CONTACT US, there is few ways to DO that.
---Secure method---
a) Download a qTOX client: hxxps://
b) Install the qTOX client and register account
c) Add our qTOX ID: 671263E7BC06103C77146A5A BB802A63F53A42B4C4766329A5F04D2660C99A3611635CC36B3A
or qTOX ID: BC6934E2991F5498BDF5D852F10EB4F7E14 59693A2C1EF11026EE5A259BBA3593769D766A275
d) Write us extension of your encrypted files .ZORN
Our LIVE SUPPORT is ready to ASSIST YOU on this chat.
----------------------------------------
| What will I get in case of agreement |
----------------------------------------
You WILL GET full DECRYPTION of your machines in the network, DELETION your data from our servers,
RECOMMENDATIONS for securing your network perimeter.
And the FULL CONFIDENTIALITY ABOUT INCIDENT.
----------------------------------------------------
Number of files that were processed is: In the picture below, you can see what a directory with files encrypted by the Zorn looks like. Each filename has the “.ZORN” extension added to it.
How did Zorn ransomware end up on my PC?
Nowadays, there are three most popular ways for tamperers to have the Zorn virus settled in your digital environment. These are email spam, Trojan introduction and peer networks.
If you open your mailbox and see emails that look like familiar notifications from utility services companies, postal agencies like FedEx, web-access providers, and whatnot, but whose sender is unknown to you, be wary of opening those emails. They are very likely to have a harmful file attached to them. Thus it is even more dangerous to open any attachments that come with letters like these.
Another thing the hackers might try is a Trojan horse model2. A Trojan is an object that infiltrates into your machine disguised as something legal. Imagine, you download an installer for some program you want or an update for some software. However, what is unpacked reveals itself a harmful program that encrypts your data. Since the update file can have any name and any icon, you’d better be sure that you can trust the resource of the files you’re downloading. The optimal way is to use the software companies’ official websites.
As for the peer-to-peer networks like BitTorrent or eMule, the danger is that they are even more trust-based than the rest of the Web. You can never know what you download until you get it. Our suggestion is that you use trustworthy resources. Also, it is reasonable to scan the directory containing the downloaded items with the antivirus as soon as the downloading is complete.
