BlackRuby-2 Ransomware

The BlackRuby-2 Ransomware is a variant of the BlackRuby Ransomware, a ransomware threat that was first reported in February 2018. The BlackRuby-2 Ransomware was first observed in the third week of March of 2018. The BlackRuby-2 Ransomware receives its name because it marks the files encrypted by the attack with the file extension '.BlackRuby2,' as well as several random characters.

How the BlackRuby-2 Ransomware Carries out Its Attack

The BlackRuby-2 Ransomware uses a combination of the AES and RSA encryptions to make the victim's files inaccessible. The BlackRuby-2 Ransomware will target the user-generated files. The following are files that PC security researchers have observed to be affected by the BlackRuby-2 Ransomware attack:

.gif, .apk, , .groups, .hdd, .hpp, .log, .m2ts, .m4p, .mkv, .mpeg , .yuv, .ndf, .nvram, .ogg, .ost, .pab, .pdb, .pif, .png, .qed, .qcow, .otp, .s3db, .qcow2, .rvt, .st7, .stm, .vbox, .vdi, .vhd, .vhdx, .vmdk, .vmsd, .psafe3, .vmx, .vmxf, .3fr, .3pr, .ab4, .accde, .accdr, .accdt, .ach, .acr, .sd0, .sxw, .adb, .agdl, .ait, .apj, .asm, .awg, .back, .backup, .sti, .oil, .backupdb, .bay, .bdb, .bgt, .bik, .bpw, .cdr3, .cdr4, .cdr5.

The BlackRuby-2 Ransomware takes the victim's files hostage, making them inaccessible and changing their file names to 'Encrypted_[string of random characters].BlackRuby2.' The BlackRuby-2 Ransomware delivers a ransom message in a program window. The BlackRuby-2 Ransomware's ransom note, which is displayed using an executable memory process named 'Windows Defender.exe,' contains the following text:

'Your files have been encrypted with the "Black Ruby Ransomware" software; the instructions (\"HOW-TO-DECRYPT-FILES.txt\") in the folders with your encrypted files are not viruses, they will help you. After reading this text, the most part of people start searching in the Internet the words the \"Black Ruby Ransomware\" where they find a lot of ideas, recommendation, and instructions. It is necessary to realise that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them.
[Have you got advice?]
*** Any attempts to get back you files with the third-party tools can be fatal for your encrypted files***
The most part of the tried-party software change data with the encrypted files to restore it but this cases damage to the files. Finally, it will be impossible to decrypt your files. When you make a puzzle, but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realise that any intervention of the third-party software to restore files encrypted with the "Black Ruby Ransomware" software may be fatal for your files. If you look through this text in the Internet and realise that something is wrong with your files but you do not have any instructions to restore your files, please contact your antivirus support.'

How to Deal with a BlackRuby-2 Ransomware Attack

The con artists are starting to integrate cryptocurrency mining malware with encryption ransomware threats like the BlackRuby-2 Ransomware. This threat installs a Monero miner on the victim's computer, using its resources to generate funds for its admins. The BlackRuby-2 Ransomware is capable of interfering with legitimate anti-virus programs and will attempt to kill at least six known anti-virus applications. The best protection against the BlackRuby-2 Ransomware is to have backup copies of your files on cloud storage or an external memory device. The BlackRuby-2 Ransomware delivers a long ransom note in the form of a text file named 'HOW-TO-DECRYPT-FILES.txt,' which is dropped on the infected computer's desktop. This file demands that the victim communicate with the cybercrooks using two different email addresses, and contains the following text:

'[Can not access your files?]
Congratulations, you are now part of our family #BlackRuby Ransomware. The range of this family is wider and bigger every day. Our hosts welcome our presence because we will give them a scant souvenir from the heart of Earth. This time, we are guest with a new souvenir called "Black Ruby." A ruby in black, different, beautiful, and brilliant, which has been bothered to extract those years and you must also endure this hard work to keep it. If you do not have the patience of this difficulty or you hate some of this precious stone, we are willing to receive the price years of mining and finding rubies for your relief and other people of the world who are guests of the black ruby.

[HOW TO DECRYPT FILES]
1. Copy "Identification Key"
2. Send this key with two encrypted files (less than 5 MB) for trust us to email address [email 1] or on the Tor network [email 2] (register in the torbox3uiot6wchz.onion and then send your request to our email address)
3. We decrypt your two files and send them to your email.
4. After ensuring the integrity of the files, you must pay us with bitcoin and
send transaction code to our email (get our bitcoin address by email).
5. You get "Black Ruby Decryptor" Along with the private key of your system.
6. Everything returns to the normal and your files will be released.'

SpyHunter Detects & Remove BlackRuby-2 Ransomware