Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Generic User Avatar

Babuk Locker Ransomware Support Topic (.babyk; How To Restore Your Files.txt)


  • Please log in to reply
30 replies to this topic

#1 Grinler

Grinler

    Lawrence Abrams


  •  Avatar image
  • Admin
  • 45,051 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:12:08 AM

Posted 30 June 2021 - 05:20 PM

Avast Threat Labs created and released a free Babuk Decryption tool using leaked source code and leaked decryption keys for victims with files encrypted by the following extensions: .babuk, .babyk, .doydo.

Cisco Talos obtained a decryption tool for the Tortilla variant of Babuk in January 2024 after the criminal was arrested.
Avast Threat Labs updated Babuk Ransomware Decryptor in January 2024.
 
 
 
A threat actor has begun to utilize a leaked Babuk Locker ransomware builder to launch a new 'Babuck Locker' campaign targeting victims all over the world.
 
The ransomware will append the .babyk extension to encrypted files and drop a ransom note named How To Restore Your Files.txt.
 
The threat actor is asking for .006 bitcoins to be sent to a bitcoin address and has provided a email address of babuckransom@tutanota.com.
 
If you were hit by this ransomware, please share how you were infected.



BC AdBot (Login to Remove)

 


#2 Meg

Meg

  •  Avatar image
  • Members
  • 705 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Netherlands
  • Local time:06:08 AM

Posted 26 August 2021 - 07:25 AM

 I had contact with someone who has been infected with this new ransomware.


"Imagination is more important than knowledge. Knowledge is limited. Imagination encircles the world." - Albert Einstein


#3 lovalim

lovalim

  •  Avatar image
  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:08:08 AM

Posted 26 October 2021 - 09:02 AM

Have anyone come across this version of ransomware where file extension got changed to .babyk.



#4 Demonslay335

Demonslay335

    Ransomware Hunter


  •  Avatar image
  • Security Colleague
  • 4,770 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:11:08 PM

Posted 26 October 2021 - 09:16 AM

It's Babuk ransomware; not decryptable, and they've had many bugs with their code that causes data corruption.


logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.


#5 quietman7

quietman7

    Bleepin' Gumshoe


  •  Avatar image
  • Global Moderator
  • 61,818 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:08 AM

Posted 26 October 2021 - 09:41 AM

@lovalim

Your topic has been merged into the primary support topic.


.
.
Microsoft MVP Alumni 2023Windows Insider MVP 2017-2020, MVP Reconnect 2016-2023

Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators
Retired Police Officer, Federal Agent and Coast Guard Chief

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif


#6 terry5285

terry5285

  •  Avatar image
  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:01:08 PM

Posted 30 December 2021 - 04:53 AM

Me again, got hit by the ransomware for the third time this year.

 

please help, i had checked some text file which got encrypted, seems only the header and footer had been added/encrypted.

 

thanks!

 

Attached Files


Edited by terry5285, 30 December 2021 - 04:55 AM.


#7 quietman7

quietman7

    Bleepin' Gumshoe


  •  Avatar image
  • Global Moderator
  • 61,818 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:08 AM

Posted 30 December 2021 - 07:45 AM

Is .cyber the full appended extension or is there an .[email], an ID number with random characters (.id-A04EBFC2, .id[4D21EF37-2214]) or an ID number with an email address (.id-BCBEF350.[<email>], .id[7A9B748C-1104].[<email>], _ID_<id***>_<email>) preceding the extension?
 
Did you find any ransom notes? If so, what is the actual name of the ransom note?
Can you provide (copy & paste) the ransom note contents in your next reply?
 
Please submit (upload) samples of encrypted files, ransom notes and any contact email addresses provided by the cyber-criminals to ID Ransomware (IDR) for assistance with identification and confirmation of the infection. ID Ransomware can identify ransomware which adds a prefix instead of an extension and more accurately identifies ransomware by filemarkers if applicable. Uploading both encrypted files and ransom notes together along with any email addresses provided gives a more positive match with identification and helps to avoid false detections. Please provide a link to the ID Ransomware results.


.
.
Microsoft MVP Alumni 2023Windows Insider MVP 2017-2020, MVP Reconnect 2016-2023

Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators
Retired Police Officer, Federal Agent and Coast Guard Chief

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif


#8 terry5285

terry5285

  •  Avatar image
  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:01:08 PM

Posted 30 December 2021 - 07:55 AM

the name of the ransom notes is Restore Files.txt

 

IDR said this ransomware is Babuk.



#9 quietman7

quietman7

    Bleepin' Gumshoe


  •  Avatar image
  • Global Moderator
  • 61,818 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:08 AM

Posted 30 December 2021 - 08:05 AM

Can you provide (copy & paste) the ransom note contents in your next reply?


.
.
Microsoft MVP Alumni 2023Windows Insider MVP 2017-2020, MVP Reconnect 2016-2023

Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators
Retired Police Officer, Federal Agent and Coast Guard Chief

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif


#10 terry5285

terry5285

  •  Avatar image
  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:01:08 PM

Posted 30 December 2021 - 08:11 AM

Happy Holidays!
 
We are CyberWarriors
 
You are -> 
 
 -> What Happened?
  Your files have been encrypted and now have the \".cyber\" extension. The file structure was not damaged.
 
 -> How to recover files?
  If you wish to decrypt your files you will need to pay in crypto. 
  The price is 10000usd but we can lower it to 7000 if you contact us within 2 days after encryption.
 
 -> 
  To check the ability of returning files, you can send to me any files.
  I will decrypt them and send back to you. That is my guarantee.
 
 -> How to contact with you?
  Contact: cyberwar4@rambler.ru
 
 ->How will the decryption process proceed after payment?
  After payment i will send exe file that is the decryptor!
 
-> Your ID:
 
  I will leak your data on the hacking forums if you don't pay!!!


#11 quietman7

quietman7

    Bleepin' Gumshoe


  •  Avatar image
  • Global Moderator
  • 61,818 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:08 AM

Posted 30 December 2021 - 03:10 PM

Avast Threat Labs created and released a Babuk Decryption tool using leaked source code and leaked decryption keys for victims with files encrypted by the following extensions: .babuk, .babyk, .doydo.

 

Unfortunately, there is no known method that I am aware of to decrypt files encrypted by newer variants of Babuk (Babuk Locker) Ransomware without paying the ransom and obtaining the private encryption keys from the criminals who created the ransomware unless they are leaked or seized & released by authorities. Without the criminal's master private key that can be used to decrypt your files, decryption is impossible. That usually means the private key is unique (specific) for each victim and generated in a secure way (i.e. RSA, AES, Salsa20, ChaCha20, ECDH, ECC) that cannot be brute-forced...the public key alone that encrypted files is useless for decryption. 
 
If feasible, your best option is to restore from backups, try file recovery software to recover (not decrypt) some of your original files or backup/save your encrypted data as is and wait for a possible solution at a later time. 
 
I will merged your topic into the primary support topic.


.
.
Microsoft MVP Alumni 2023Windows Insider MVP 2017-2020, MVP Reconnect 2016-2023

Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators
Retired Police Officer, Federal Agent and Coast Guard Chief

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif


#12 totoe

totoe

  •  Avatar image
  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:12:08 PM

Posted 16 March 2023 - 07:24 AM

Hi All,

 

Our ESXi Server was attacked from ransomware .XVGA extension.

 

That's attacked for all files in our Datastore. please see attached for information.

 

Please help how to investigate _/\_

Attached Files



#13 quietman7

quietman7

    Bleepin' Gumshoe


  •  Avatar image
  • Global Moderator
  • 61,818 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:08 AM

Posted 16 March 2023 - 08:45 AM

When did this attack happen?

 

Contents of HowToRestore.txt

============================================ 
=================WARNING!=================== 
====YOUR SECURITY PERIMETER WAS BREACHED==== 
============================================ 
  
Over 500 gigabytes of highly sensitive files 
were stolen from your network . You can read 
the full stolen data sheet and get the proof 
in the dialogue with us. 
 
Don't modify, rename, copy or move any files 
or you can DAMAGE them! 
Shutdown or Reset your system, it can DAMAGE 
files! 
 
If no contact with us or deal made in 3 days 
decryption key will be deleted permanently   
and all your data will be sold! 
============================================ 
For contact us use this mailbox: 
 
 spaceit@techmail.info 
 itlab@cyberfear.com 
 
Your decryption ID: OTvPYpaJcjQwD7tBYpiel3yb 

 

 


.
.
Microsoft MVP Alumni 2023Windows Insider MVP 2017-2020, MVP Reconnect 2016-2023

Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators
Retired Police Officer, Federal Agent and Coast Guard Chief

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif


#14 totoe

totoe

  •  Avatar image
  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:12:08 PM

Posted 16 March 2023 - 09:58 AM

 

Looks like New ESXi attack. 

 

When did this attack happen?

 

Contents of HowToRestore.txt

============================================ 
=================WARNING!=================== 
====YOUR SECURITY PERIMETER WAS BREACHED==== 
============================================ 
  
Over 500 gigabytes of highly sensitive files 
were stolen from your network . You can read 
the full stolen data sheet and get the proof 
in the dialogue with us. 
 
Don't modify, rename, copy or move any files 
or you can DAMAGE them! 
Shutdown or Reset your system, it can DAMAGE 
files! 
 
If no contact with us or deal made in 3 days 
decryption key will be deleted permanently   
and all your data will be sold! 
============================================ 
For contact us use this mailbox: 
 
 spaceit@techmail.info 
 itlab@cyberfear.com 
 
Your decryption ID: OTvPYpaJcjQwD7tBYpiel3yb 

 

 

 

It's happen on 13 March, the ransomware encrypted every file inside datastore



#15 quietman7

quietman7

    Bleepin' Gumshoe


  •  Avatar image
  • Global Moderator
  • 61,818 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:08 AM

Posted 16 March 2023 - 03:16 PM

Yours looks like the only report thus far.

 

An Internet search only reveals this topic.


.
.
Microsoft MVP Alumni 2023Windows Insider MVP 2017-2020, MVP Reconnect 2016-2023

Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators
Retired Police Officer, Federal Agent and Coast Guard Chief

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif





1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users