What is B2DR ([email protected]) ransomware? And how does it execute its attack?
B2DR ([email protected]) ransomware is a file-encrypting malware and is a new variant of B2DR ([email protected]) ransomware, hence the name. This new variant was released in June 2018 and follows the other two previous variants of B2DR ([email protected]) that appends the [email protected] and [email protected] extensions.
Based on the analysis done by security experts, nothing much has changed in this new variant, save for the extensions it uses in marking the files it encrypts. During the infiltration, the crypto-malware is launched in the system using a malicious executable file. This executable file is also responsible for connecting the infected computer to a remote C&C server where it downloads more malicious files. These other malicious files are dropped in the system folder and programmed to stop any programs installed in the system from impeding its attack. These files are also set to modify the Windows Registry, particularly the RunOnce sub-keys to make sure that B2DR ([email protected]) ransomware can run on every system boot. After these alterations, it will begin to look for files with the following extensions:
.3dm, .3g2, .3gp, .7zip, .aaf, .accdb, .aep, .aepx, .aet, .ai, .aif, .as, .as3, .asf, .asp, .asx, .avi, .bmp, .c, .class, .cpp, .cs, .csv, .dat, .db, .dbf, .doc, .docb, .docm, .docx, .dot, .dotm, .dotx, .dwg, .dxf, .efx, .eps, .fla, .flv, .gif, .h, .idml, .iff, .indb, .indd, .indl, .indt, .inx, .jar, .java, .jpeg, .jpg, .js, .m3u, .m3u8, .m4u, .max, .mdb, .mid, .mkv, .mov, .mp3, .mp4, .mpa, .mpeg, .mpg, .msg, .pdb, .pdf, .php, .plb, .pmd, .png, .pot, .potm, .potx, .ppam, .ppj, .pps, .ppsm, .ppsx, .ppt, .pptm, .pptx, .prel, .prproj, .ps, .psd, .py, .ra, .rar, .raw, .rb, .rtf, .sdf, .sdf, .ses, .sldm, .sldx, .sql, .svg, .swf, .tif, .txt, .vcf, .vob, .wav, .wma, .wmv, .wpd, .wps, .xla, .xlam, .xll, .xlm, .xls, .xlsb, .xlsm, .xlsx, .xlt, .xltm, .xltx, .xlw, .xml, .xqx, .xqx, .zip
As usual, just like other variants of B2DR, this one also uses the AES 256 encryption algorithm in encrypting the targeted files listed above. Once it completes encrypting them, it adds the [email protected] extension to each one of the files. It then releases its ransom note contained in a text file named “ScrewYou.txt” that states:
“Your files were encrypted with AES-256.
Ask how to restore your files by email [email protected]
Use only gmail.com, yahoo.com, protonmail.com.
Messages are written from other mail services we cannot get.
We always respond to messages. If there is no answer within 24 hours, then write us with another email service.
[OR]
If within 24 hours you have not received a response, you need to follow the following instructions:
- a) Download and install TOR browser: https://www.torproject.org/download/download-easy.html.en
- b) From the TOR browser, follow the link: torbox3uiot6wchz.onion
- c) Register your e-mail (Sign Up)
- d) Write us on e-mail: [email protected]
ATTENTION: e-mail ([email protected]) accepts emails, only with e-mail registered in the TOR browser at torbox3uiot6wchz.onion
################################
Any actions on your part over encrypted files can damage them. Be sure to make backups!
################################
In the message write us this ID:
[redacted base64]—–END KEY—–”
If you are one of the unlucky users who has fallen victim to B2DR ([email protected]) ransomware, contacting them to pay the ransom is certainly not recommended as these crooks are not really known to keep their promises to their victims once they get what they want. So the best way to deal with this threat is by terminating it from your computer immediately.
How is the malicious payload of B2DR ([email protected]) ransomware disseminated?
The malicious payload of B2DR ([email protected]) ransomware may be disseminated in spam emails and it may look like a ZIP file, a PDF file or a document with macro scripts – whichever one it may be, you must not open them. Thus, you have to double check every email you receive as it may contain the malicious payload of ransomware threats like B2DR ([email protected]) ransomware.
You need to terminate B2DR ([email protected]) ransomware the moment you notice it infiltrating your system. To do so, follow the set of instructions below carefully.
Step 1: Tap Ctrl + Shift + Esc keys to launch the Task Manager.
Step 2: Go to Processes and look for the malicious process of B2DR ([email protected]) ransomware then right click on it and select End Process or End Task.
Step 3: Close the Task Manager and open Control Panel by pressing the Windows key + R, then type in appwiz.cpl and then click OK or press Enter.
Step 4: Look for dubious programs that might be related to B2DR ([email protected]) ransomware and then Uninstall it/them.
Step 5: Tap Win + E to launch File Explorer.
Step 6: After opening File Explorer, navigate to the following directories below and look for the malicious components of B2DR ([email protected]) ransomware like the text file named ScrewYou.txt and remove them all.
- %TEMP%
- %APPDATA%
- %DESKTOP%
- %USERPROFILE%\Downloads
- C:\ProgramData\local\
Step 7: Close the File Explorer.
Make sure that you are tech savvy enough to the point where you know exactly how to use and navigate your computer’s Registry before you proceed to the next steps below. Keep in mind that any changes you make will highly impact your computer. To save you the trouble and time, you can just use [product-name], this system tool is proven to be safe and excellent enough that hackers won’t be able to hack into it. But if you can manage Windows Registry well, then, by all means, go on to the next steps.
Step 8: Tap Win + R to open Run and then type in regedit in the field and tap enter to pull up Windows Registry.
Step 9: Navigate to the listed paths below and look for the registry keys and sub-keys created by B2DR ([email protected]) ransomware.
- HKEY_CURRENT_USER\Control Panel\Desktop\
- HKEY_USERS\.DEFAULT\Control Panel\Desktop\
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Step 10: Delete the registry keys and sub-keys created by B2DR ([email protected]) ransomware.
Step 11: Close the Registry Editor.
Step 12: Empty the contents of Recycle Bin.
Refer to the next advanced steps below to ensure the complete removal of B2DR ([email protected]) ransomware from your system.
Perform a full system scan using [product-code]. To do so, follow these steps:
- Turn on your computer. If it’s already on, you have to reboot
- After that, the BIOS screen will be displayed, but if Windows pops up instead, reboot your computer and try again. Once you’re on the BIOS screen, repeat pressing F8, by doing so the Advanced Option shows up.
- To navigate the Advanced Option use the arrow keys and select Safe Mode with Networking then hit
- Windows will now load the SafeMode with Networking.
- Press and hold both R key and Windows key.
- If done correctly, the Windows Run Box will show up.
- Type in the URL address, [product-url] in the Run dialog box and then tap Enter or click OK.
- After that, it will download the program. Wait for the download to finish and then open the launcher to install the program.
- Once the installation process is completed, run [product-code] to perform a full system scan.
- After the scan is completed click the “Fix, Clean & Optimize Now”button.
