BBC Ransomware

The BBC Ransomware is a crypto-virus related to the big old Phobos Ransomware family. Similar to all its Phobos siblings, the BBC Ransomware springs into action pursuing one single goal – to take some data hostage and extort money from the victim owning those data. To do that, the BBC Ransomware needs to:

• Find its way to a targeted PC, usually via Trojans, infected macros in email attachments, malware-laden websites or suspicious Web advertisements;
• Encrypt the victim’s files and
• Draw up the ransom note with instructions regarding the compensation amount required in exchange for a decryption key.

In the case of a BBC Ransomware infection, all encrypted files are modified by the following pattern:
[File_name].docx =>[File_name].docx.id[Victim’s_ID].[Crook’s_Email_Address].bbc.

The pattern mentioned above has just one variable – the victim’s ID, a unique combination of random characters assignable to each infected PC. The crook’s email address also may vary, but it is limited to the few domains utilized by the crooks at play. For example, BBC’s ransom note provides not one but two email addresses.
Speak of the devil, the ransom note shows up both as a text and an HTML file dubbed ‘info.txt’ and ‘info.hta,’ respectively. Here is the text of both files:

Ransom Note #1: Info.txt
'!!!All of your files are encrypted!!!
To decrypt them send e-mail to this address: 0x1service@protonmail.com.
If we don't answer in 24h., send e-mail to this address: 0x1service@airmail.cc.'

Ransom Note #2: Info.hta
All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail 0x1service@protonmail.com
Write this ID in the title of your message -
In case of no answer in 24 hours write us to this e-mail:0x1service@airmail.cc
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.
Free decryption as guarantee
Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
hxxps://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
hxxp://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

The notes do not stipulate the exact ransom amount. Rather, they require the victims to contact the crooks via email if they want to know how much they will have to pay to get their data back. This has become the norm nowadays and may allow for a discriminating approach when determining the required amount for each user. The latter, which is payable in Bitcoins, may vary depending on how swift the victim’s reaction is. The inclusion of a second email contact after the first 24 hours has passed, is indicative of a potentially higher compensation amount than what would be required when the victims act within the first day (and night).
Although the crooks behind the BBC Ransomware promise to decrypt up to 5 files for free, we urge you never to agree to pay the demanded ransom. Even if they did have a working decryption tool, you can never be sure whether they would hold on to their promise or not. Sometimes, they do, but more often they don’t. That’s why backing up your data on a regular basis should always be your first and strongest line of defense.

What if the damage is done? If you’ve already fallen prey to a BBC Ransomware infection without having backed up your files, you will lose your data, but you should remove the ransomware from your PC nonetheless. You may do so by installing a reputable anti-malware program after you start your Windows PC in Safe Mode with Networking. If that doesn’t work, try restoring your system to one of your automatic Restore Points and install a reputable malware removal tool to protect yourself against future malware infections.