Rrbb Ransomware
The popularity of the STOP/Djvu ransomware strain among cybercriminals continues to remain strong and the evidence for it is the constantly growing number of variants being uncovered by infosec researchers. One such threat is Rrbb Ransomware. Despite being yet another variant, the threat's capacity to cause damage is undeniable.
Once executed on the breached computer system, Rrbb Ransomware will be responsible for encrypting the vast majority of the data stored there. The victim's documents, archives, databases, and other important files will all be left in an unusable state. The malware marks each encrypted file by adding '.rrbb' to that file's original name. Upon locking all targeted file types, Rrbb Ransomware will create a text file named '_readme.txt' on the device. The role of the text file is to contain a ransom note with the demands of the threat actors.
Ransom Note Details
The ransom-demanding message of the threat follows closely the established formula observed in other STOP/Djvu variants. It states that victims who wish to receive the decryption tool and necessary decryption keys from the cybercriminals will need to pay a ransom of exactly $980. However, if users contact the attackers within the first 3 days following the breach, they will only need to pay half of that. Two email addresses can be used for communication - 'support@bestyourmail.ch' and 'supportsys@airmail.cc.' Of course, contacting and negotiating with cybercriminals is strongly discouraged as doing so can expose users to additional privacy or security risks.
The full text of the threat's note is:
ATTENTION!
Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-5JlAL7HXIu
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.
To get this software you need write on our e-mail:
support@bestyourmail.ch
Reserve e-mail address to contact us:
supportsys@airmail.cc
Your personal ID:
