Geek's Advice

BBBR ransomware locks your data for a ransom

BBBR ransomware is a new variant of STOP/DJVU file-encrypting virus family. Just like other variants, this file-encrypting virus is dangerous and highly destructive. It is known to encrypt every file it comes across in an infected computer while appending each file name with .bbbr extension. E.g., file 1.jpg saved in the compromised computer will be automatically renamed to 1.jpg.bbbr and the same process will be repeated on all other data. While the attack is still ongoing, the malware will release certain ransom notes known as _readme.txt in all the folders. Contained in the notes are pieces of information notifying the victim about what just happened and why they should reach out to those behind the attack for a possible ransom payment in exchange for a promised decryption tool.

The cybercriminals would point out that BBBR ransomware has encrypted the entire data contained in the victim’s computer with the use of very strong and complex key that can’t be bypassed. Therefore, there is no alternative than to pay certain amount of money to the cybercriminals as ransom so they could provide decryption services to the victim. To facilitate further discussion, two email addresses will be attached for the victim to respond accordingly. The emails are: support@sysmail.ch and helpsupportmanager@airmail.cc.

They will also attach their decryption service prices and the terms of payment associated with it. According to them, the victim should write to them within 72 hours, i.e. 3 days after being notified and comply with their demands so they could be liable to a 50% discount. In other words, they would now have to pay only $490 instead of $980. However, failure to meet up within the deadline means they would have to pay the full amount.

If the victim responds to them, they will reel out more conditions. For instance, they will state that only payments made with cryptocurrency worth the exact ransom fee would be acceptable and to that effect, they make their wallet address available. The obvious reason why they usually chose this medium is because of the anonymity it offers them. Other channels of payment would put them at significant risk of being tracked down and arrested. To assure the victim about their expertise, they may request for samples of the encrypted files to be sent to them for test decryption. However, they will be quick to add that such excerpt must not contain information that could be perceived as important.

Our cybersecurity experts advise victims to always follow FBI recommendations as regards to ransom payments, and it SAYS NO TO RANSOM PAYMENTS! Here is the reason why we all agree that ransom shouldn’t be paid to cybercriminals:

• There is no guarantee of file/data recovery even after paying ransom
• Paying ransom to them would only encourage them to continue in their criminal activities
• Paying ransom would help them to expand their activities, thereby leading to more victims
• You could put yourself at further risk because they could give you Trojans like AZORULT or VIDAR disguised as decryptors (they could be used to steal vital information such as account login details, cryptocurrency wallets, browsing history, banking details, and passwords etc.)

If your computer is already infected with any variant of STOP/DJVU malware, you’re advised to remove BBBR ransomware virus as quickly as possible. The best way to go about it is to boot your computer using Safe Mode with Networking option, then run a genuine antivirus on it. Our team recommends using INTEGO Antivirus (you can read its review here). Additionally, we recommend you to download RESTORO to try and repair virus damage on Windows OS files.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Ransomware distribution techniques everyone should be wary of

The most common way STOP/DJVU ransomware variants including BBBR virus are distributed is through downloading of malicious torrents. Cybercriminals often load them in pirated software contents and they become activated once users download them in their various computers. Most of the so-called key generators and “cracks” as well as other popular but cloned software contents are the ones mostly exploited by them. Studies and aggregate data from victims show that the most common ones are:

• VMware Workstation;
• Fifa 20;
• Tenorshare 4ukey;
• AutoCad;
• Opera browser;
• Corel Draw;
• Adobe Photoshop;
• Cubase;
• Adobe Illustrator;
• League of Legends;
• Internet Download Manager;
• KMSPico (illegal Windows activation tool).

For those that indulge in the habit of visiting online software torrents, you’re hereby advised to desist from it. You could fall victim to cybercriminals at any moment and the consequences would be unpalatable. At the moment, it may appear cheap to source for activators, game versions and other contents at little or no cost, but what you could eventually lose to cybercriminals would be massive. Also note that copyright infringement is subject to prosecution in the law court. Instead of putting yourself through all these, it is better to obtain them legally through the legitimate channels. By so doing, you will be helping the industry to grow.

Another major way of spreading ransomware is through malicious email attachments, whereby cybercriminals would compose carefully scripted messages using formats such as XLS, DOCX and PDF or any similar one that support macro functions or JavaScript. In this way, they can successfully download the payload and also trigger it indiscriminately in other computers.

In recent times, it has become increasingly difficult to easily decipher if a particular email is genuine or having malicious intents. Cybercriminals are now impersonating other people or even notable brands which can take unsuspecting people unawares. In their desperation, they now caption their emails with terms such as Invoice, Tracking details, Order Summary and other similar names in order to throw their victims off-guard. Sometimes, they may decide to use email spoofing gimmicks to hide the actual sender’s address. Whatever be the case, we advise people to always trust their instincts; if something doesn’t look right about an email, then you should consider not opening it.

Victims of STOP/DJVU ransomware should not loose guard while thinking that the worst has been done. On the contrary, you should continue being vigilant and avoid suspicious websites that claim to provide decryption solutions. Such solutions hardly exist and most of the websites advertising them are shady and have dubious aims. They are notorious for distributing other ransomware variants and Trojans like ZORAB which they camouflage as STOP/DJVU decryptors. Your files could end up doubly encrypted when you download them.

More details you need to know about the infection

We will be discussing about the technical aspect of the infection. So, here is what happens during BBBR ransomware attack. Firstly, the malware arrives in an executable file named with 4 random characters, for example, 1GB8.exe and will launch what is known as build.exe or build2.exe executables and also winupdate.exe. After that, it will connect to https[:]//api.2ip.ua/geo.json and would save the result in geo.json file. The malware then gathers necessary detail about the computer such as its zip code, time zone, latitude and longitude, geolocation, etc. and forwards them to the central control server. Displayed in the image below are two examples of the geo.json file.

The virus also collects various details about the computer, including hardware specifics, installed software list and active processes into information.txt file as shown below.

It then compares the information gathered about the computer against a list of countries they designated as encryption forbidden nations. They include Belarus, Russia, Tajikistan, Uzbekistan, Syria, Kazachstan, Ukraine, Kyrgyzstan and Armenia. If it indicates that the computer is domiciled in any of these countries, it will immediately stop any further action. However, if it doesn’t, the ransomware will proceed by fetching online encryption key from their central server and will combine it with the victim’s ID and would save them in the bowsakkdestx.txt file and to PersonalID.txt file.

Examples of these files are shown below.

In situations whereby the virus couldn’t fetch any online encryption ID, it will resort to the use of offline encryption ID. What sets the two ID’s apart is that online encryption ID is uniquely created for each victim while offline ID is a one-size-fits-all. The use of offline ID means there is a high chance that the encrypted files could be decrypted someday unlike the online ID. You can detect if offline ID was used if there is presence of t1 characters at the end of the personal ID. Check this article for more details about it.

Afterwards, the ransomware would fully commence data encryption process by scanning the folders while encrypting every file using Salsa20, then makes use of RSA-2048 to lock the encryption key. While this is still going on, the files will be marked with additional extension (.bbbr).

Displayed in the screenshot below is _readme.txt ransom note the malware typically drops in all folders.

At this point, the malware would leverage a Command Prompt task to delete Volume Shadow Copies, example of it is shown here:

^{vssadmin.exe Delete Shadows /All /Quiet}

Before concluding the process, the virus would add a number of domains to the Windows HOSTS file, and then forwards them to the local host IP. It does this in order to preempt any possible attempt by the victim to seek help online. If peradventure the victim tries to access any of the blacklisted domains, an error message will appear on the screen in this format: DNS_PROBE_FINISHED_NXDOMAIN. The obvious reason why the cybercriminals does this is to frustrate the victim and make them helpless.
As stated earlier, additional malware would be dropped by the ransomware in the form of Trojans like AZORULT or VIDAR.

Remove BBBR Ransomware Virus and Recover Your Files

For those that are victims already, it would be in your best interest to report the cybercrime attack to local law enforcement agency to handle such incidents. You should also remove BBBR ransomware virus from your computer as quickly as possible. Please go through the guidelines provided below for more details. However, before making use of the antivirus in removing the malware, it is important to boot your computer in the Safe Mode with Networking. This sets up the computer with limited functions thus enabling the antivirus to work at its optimal capacity. If you’re not sure of any reliable antivirus you can make use of, then you go for INTEGO Antivirus because it is tested and trusted.

Please go through these recommendations as outlined by our team:

• Remove the virus as quickly as possible from the compromised computer;
• Report to any government agency responsible for handling such issues within your locality.
• Now is time to make use of your backup devices to restore your lost data but ensure that the antivirus was able to remove the malware completely before plugging any external storage device.
• Learn about the possibility of repairing/decrypting files that were infected with STOP/DJVU variants.
• Urgently change all passwords that were used on the computer.
• Download RESTORO to repair all Windows OS files damaged by malware.

Whether you’re a victim of any STOP/DJVU ransomware variant or you’ve never experienced any cyber-attack before, it is still necessary to be on guard at all times.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.