PartiZAN32 Ransomware

What is PartiZAN32?

PartiZAN32 is a type of ransomware from the Xorist family. It was identified by our team through an analysis of samples from the VirusTotal website. This malware encrypts files and adds a unique extension (“.xqwertzuioplkjhgfyxcvbnmD”) to the affected filenames, along with changing the desktop wallpaper.

PartiZAN32 Ransomware
PartiZAN32 Ransomware

The ransomware creates two ransom notes: one as a text file named “HOW TO DECRYPT FILES.txt” and another as a pop-up message. For instance, it renames files like “1.jpg” to “1.jpg.qwertzuioplkjhgfyxcvbnmD“.

More About PartiZAN32

PartiZAN32 locks files, rendering them inaccessible, and demands a ransom, usually in cryptocurrency, to unlock them. Paying the ransom does not guarantee file recovery and might encourage further criminal activities. It’s crucial for users to maintain backups on separate devices to minimize losses.

PartiZAN32 Ransomware can infect computers through malicious emails, software vulnerabilities, or pirated software containing malware. Users might also encounter malicious ads or scams that lead to infections. Another method includes the use of infected USB drives or other malware that installs ransomware.

Details of the Ransom Note

The ransom note informs victims that their files have been encrypted by PartiZAN32. It demands that victims contact a provided email ( to obtain a free decryption key. It warns victims against attempting decryption without the attackers’ help, mentioning that multiple failed attempts could lead to the sale of their information on the dark web.

PartiZAN32 Ransom Note: HOW TO DECRYPT FILES.txt
PartiZAN32 Ransom Note: HOW TO DECRYPT FILES.txt

Oopsie Daisy! Your files have been encrypted by PartiZAN32.

How Do I Recover My Files?
By G-Mailing, we will give you the key for free! Yep, free. YOU'RE A LUCKY!
Your ID:0905
Key: 0,00USD
After getting the key, please click on any encrypted file or simply reclick the ransomware. A little tab will appear. You will insert the key there and PartiZAN32 is gone from you computer! (Don' attemp to decrypt without key, you will damage your files)

You Have 5 attempts to insert the correct key, if all 5 attempts are gone, all your files and IPADRESS will be sold on the dark web!

Screenshot of PartiZAN32’s desktop wallpaper:

Desktop Wallpaper
Desktop Wallpaper


To protect yourself, avoid opening email attachments or clicking links from unknown sources. Only download from official sources and be vigilant during software installations. Keep your system and software updated, and use reputable security tools to detect and remove threats.

Removing PartiZAN32 Ransomware

If your system is infected with PartiZAN32, using a tool like Trojan Remover for Windows is recommended to help remove this ransomware effectively.

Loaris Trojan Remover stands out as the premier choice for eradicating the ransomware threat and restoring your system. It boasts an advanced scanning engine that detects ransomware in all forms and allows for targeted scans with its Custom Scan feature.

To navigate around the ransomware’s execution blocks, boot your PC in Safe Mode with Networking. This can be done through the Troubleshooting panel by restarting your PC while holding the Shift key, navigating to Startup Settings, and selecting Windows 10 Safe Mode with Networking.

Reboot PC into Safe Mode
Reboot PC into Safe Mode

In Safe Mode, launch the Loaris installer, follow the installation prompts, and activate the free trial for full functionality.

Trojan Remover main screen
Trojan Remover Main Screen

Conduct a full scan, review the list of detected threats, and proceed with the recommended removal actions.

Loaris scan for PartiZAN32 virus
Scanning for PartiZAN32 Files

Recovering Files with PhotoRec

Download PhotoRec, specify the disk or partition and desired file formats for recovery and start the recovery process to salvage your encrypted data.

File Recovery for PartiZAN32
Files Recovery

Leave a Comment