Bbnm Ransomware
The Bbnm ransomware is yet another clone of the Djvu ransomware. The Djvu ransomware is a large group of ransomware clones, all based on Djvu code and encryption methods.
There is little that sets apart the Bbnm ransomware. Even the name suggests that there wasn't much effort put into customizing the malware. Once Bbnm finds its way into a system and executes, it encrypts popular file extensions including media files, office documents, databases and more or less every non-essential file.
Encrypted files keep their original filenames, but receive the .bbnm extension. This means that a file that was originally called "schedule.xslx" will turn into "schedule.xslx.bbnm" once it has been encrypted by the ransomware.
The threat actors behind Bbnm ask for nearly a thousand dollars in ransom. The ransom note is contained in a file called "_readme.txt".
The full text of the ransom note goes as follows:
ATTENTION!
Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-6Ti2DxXR3I
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.
To get this software you need write on our e-mail:
manager at time2mail dot ch
Reserve e-mail address to contact us:
supportsys at airmail dot cc
Your personal ID:
Even though there is a freely available tool that can decrypt a significant number of Djvu ransomware clones, their ever-growing number and constant additions of new strains into the family mean that new versions will likely not be decrypted by the available tool.
