BACKJOHN Ransomware Encrypts Victim Files

During the analysis of malware samples, our researchers discovered BACKJOHN, a type of ransomware that belongs to the Phobos family. BACKJOHN operates by encrypting data, modifying filenames of encrypted files, and generating ransom notes in the form of "info.hta" and "info.txt" files.

To filenames, BACKJOHN appends the victim's ID, an email address (backjohn131@gmail.com), and the ".BACKJOHN" extension. For example, "1.jpg" is changed to "1.jpg.id[9ECFA84E-3143].[backjohn131@gmail.com].BACKJOHN", while "2.png" becomes "2.png.id[9ECFA84E-3143].[backjohn131@gmail.com].BACKJOHN", and so on.

The ransom note instructs the victim to contact the attacker at backjohn131@gmail.com and to include a specific ID in the message title. If there is no response within 24 hours, the victim should send a message to backjohn@tutanota.com.

The attacker demands payment in Bitcoin for the decryption of the victim's files, with the amount depending on how quickly the victim contacts the attacker. The ransom note provides free decryption for up to five files as a guarantee before payment, but with restrictions on file size and type.

The ransom note also warns the victim against renaming the encrypted files or attempting decryption with third-party software, as it could lead to permanent data loss or an increase in ransom costs.

BACKJOHN Uses Standard Phobos Ransom Note

The complete text of the ransom note message generated by BACKJOHN reads as follows:

All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail backjohn131@gmail.com
Write this ID in the title of your message -
In case of no answer in 24 hours write us to this e-mail:backjohn@tutanota.com
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.
Free decryption as guarantee
Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
hxxps://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
hxxp://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

How Can You Protect Your System from Ransomware Like BACKJOHN?

Here are some steps you can take to protect your system from ransomware like BACKJOHN:

• Install and regularly update reputable antivirus and anti-malware software: This will help detect and prevent malicious software from infecting your system.
• Keep your operating system and all software up to date: Software updates often include security patches that address known vulnerabilities that ransomware can exploit.
• Backup your data regularly: Make sure to backup your important data regularly to an external hard drive or cloud-based storage service. This will enable you to restore your data in case it gets encrypted by ransomware.
• Be cautious of suspicious emails and attachments: Ransomware is often spread through phishing emails that contain malicious attachments or links. Be wary of any email or attachment from an unknown sender or one that appears suspicious.
• Enable firewalls and other security features: Enable firewalls, spam filters, and other security features that can help block ransomware from infiltrating your system.
• Educate yourself and your employees: Educate yourself and your employees about ransomware and how it spreads. Train them on safe email practices, and how to recognize and report suspicious emails.
• Use strong passwords and two-factor authentication: Use strong passwords and two-factor authentication to secure your accounts and prevent unauthorized access.

By following these steps, you can help protect your system from ransomware like BACKJOHN and other malicious software.