Babuk — 20210203

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

1. Message 001 From Babuk Actor / other Date Not recorded

   Hello! Technical support is ready to answer you

2. Message 002 From Victim Victim Date Not recorded

   Hello, I'm writing on behalf of [redacted]. Is this the right place to ask for information?

3. Message 003 From Babuk Actor / other Date Not recorded

   Hello! That's right, to start a dialogue, I ask you to answer 2 questions 1) Are you a recovery company 2) Do you have insurance against ransomware programs?

4. Message 004 From Victim Victim Date Not recorded

   1) I'm not part of a recovery company. We are an IT company working with them in other fields. We just decided to give them a hand in handling contacts with you, since they do not have the required technical knowledge. 2) I have no information regarding that matter unfortunately, i do not know if they have insurance or not (though I'd bet they don't)

5. Message 005 From Babuk Actor / other Date Not recorded

   Before we move on to discussing the price, upload 4-5 files of encrypted files no more than 10MB using any file exchanger, we will decrypt these files as a test

6. Message 006 From Victim Victim Date Not recorded

   ok, I'll come back as soon as I have them, just need a moment to collect them. is something like a link shared via Google drive OK for you?

7. Message 007 From Babuk Actor / other Date Not recorded

   Ok, write to me as you are ready to provide files

8. Message 008 From Babuk Actor / other Date Not recorded

   Also send us the ecdh_pub_k.bin file from those computers from which you will download files, this ecdh_pub_k.bin will be placed in% appdata%

9. Message 009 From Victim Victim Date Not recorded

   ok, I'll be back in some minutes to tell you how much time we'll have to wait (i can't recover the data myself unfortunately)

10. Message 010 From Babuk Actor / other Date Not recorded

    Ok

11. Message 011 From Babuk Actor / other Date Not recorded

    independent attempts without our help to decrypt files may lead to their loss, I would not advise you to do this

12. Message 012 From Victim Victim Date Not recorded

    don't worry, we know how this type of issues work, we prevented them from attempting anything rush

13. Message 013 From Victim Victim Date Not recorded

    ok, i should be able to recover 4-5 files and the related public key in a couple of hours. I'll text you back then. for now, thanks for the information

14. Message 014 From Babuk Actor / other Date Not recorded

    ok

15. Message 015 From Victim Victim Date Not recorded

    You can find a simple archive with three files and your public key at the following link: https://file.io/[redacted]

16. Message 016 From Victim Victim Date Not recorded

    The content is a 7z archive password-protected. The password is "[redacted]" (without quotes)

17. Message 017 From Victim Victim Date Not recorded

    Be careful because I fear the link will expire after one download

18. Message 018 From Babuk Actor / other Date Not recorded

    I downloaded your files, please wait

19. Message 019 From Babuk Actor / other Date Not recorded

    link will be available for 1st download https://dropmefiles.com/[redacted]

20. Message 020 From Victim Victim Date Not recorded

    Downloaded, received and correctly visualized the plaintext, thanks for the proof of work

21. Message 021 From Victim Victim Date Not recorded

    Can I move on to ask you about your demands?

22. Message 022 From Babuk Actor / other Date Not recorded

    Ok, now we can continue the dialogue

23. Message 023 From Babuk Actor / other Date Not recorded

    yes, 1 minets please

24. Message 024 From Babuk Actor / other Date Not recorded

    We know that [redacted] is a large company with an annual turnover of $ [more than two dozens] million a year, a price of $ 400,000 for a complete expansion of all systems

25. Message 025 From Victim Victim Date Not recorded

    I'll refrain from reacting to it: I'll just tell you that such an amount is simply impossible to move for an Italian company. There is no way a company would be able to purchase that amount of coins (bitcoins or whatever else) in a whole year. It *might* be doable if they were like 20, 30 thousands, but more than that seems totally impossible to me.

26. Message 026 From Victim Victim Date Not recorded

    Anyway, I'll relay your demands to the company, I'll forward your feedback to you as soon as they answer me

27. Message 027 From Victim Victim Date Not recorded

    Anyway, I'll relay your demands to the company, I'll forward your feedback to you as soon as they answer me

28. Message 028 From Victim Victim Date Not recorded

    Thanks for your cooperation, for now

29. Message 029 From Victim Victim Date Not recorded

    "I'll forward THEIR feedback to you" (typo)

30. Message 030 From Victim Victim Date Not recorded

    BTW, I'll probably be back in some hours, since it's late evening in Italy and I don't think they'll answer me now. I'll be back as soon as possible

31. Message 031 From Babuk Actor / other Date Not recorded

    We can make a discount, but it must be reasonable, we will wait for comments from the company and we are waiting for you in this cha

32. Message 032 From Babuk Actor / other Date Not recorded

    Ok, we are in touch and ready for a dialogue, and ask them about insurance

33. Message 033 From Victim Victim Date Not recorded

    Hi we talked with the company. For them the damage is 1 month of work of 4 people and is worth 40k because have an offline backup. For you can be ok?

34. Message 034 From Babuk Actor / other Date Not recorded

    We understand perfectly well that if you had backups, if you didn’t have a dialogue with us, we can accept. from you 100 000 usd, it will be a big discount, if you agree then we will move on to the deal, if you need time to think it over, this is your time in any case you need the decryptor, not me

35. Message 035 From Victim Victim Date Not recorded

    they have ready 55k usd to close the deal and for Wednesday you'll have the money in your wallet. Can you agree with it?

36. Message 036 From Babuk Actor / other Date Not recorded

    We understand that the company can afford to pay 100 00, we went to you for the purchase and made a big discount

37. Message 037 From Babuk Actor / other Date Not recorded

    100 000

38. Message 038 From Victim Victim Date Not recorded

    I'll talk with them

39. Message 039 From Babuk Actor / other Date Not recorded

    Ok, also if they have insurance, this will not incur financial losses for them at all, the insurance will pay everything

40. Message 040 From Victim Victim Date Not recorded

    they don't have an insurance

41. Message 041 From Babuk Actor / other Date Not recorded

    Well then, I advise you to buy it in the future.

42. Message 042 From Victim Victim Date Not recorded

    in italy with the italian law it's hard to cash out this amount. With difficulties we can arrive to 65k.

43. Message 043 From Babuk Actor / other Date Not recorded

    We had clients from italy who could easily pay 350,000, let's stop at 85k, it will be optimal for you and us!

44. Message 044 From Victim Victim Date Not recorded

    I'm talking with them. Please 5 minutes

45. Message 045 From Babuk Actor / other Date Not recorded

    ok

46. Message 046 From Victim Victim Date Not recorded

    BTW just genuinely asking: how did they pay you such an amount? i can't imagine a way to move 350k from Italy in few days, it's just really difficult unless it happens via bank wire

47. Message 047 From Babuk Actor / other Date Not recorded

    They worked with the bank, we cannot tell you the company, for the reason: they paid, we keep secret information about our clients who made the transaction

48. Message 048 From Victim Victim Date Not recorded

    sure, as I said I was just asking out of curiosity. Anyway, we convinced them to make an effort for 85k usd, since it's in the interest of their business.

49. Message 049 From Babuk Actor / other Date Not recorded

    Okay, do you need instructions on how to buy bitcoin? Or will you do everything yourself?

50. Message 050 From Victim Victim Date Not recorded

    I'll speak with them to understand how they want buy it

51. Message 051 From Babuk Actor / other Date Not recorded

    ok

52. Message 052 From Victim Victim Date Not recorded

    can you give us your instruction to pay you?

53. Message 053 From Babuk Actor / other Date Not recorded

    There are bitcoin ATMs in italy, you can use it or buy bitcoins on the exchange https://www.finder.com/it/how-to-buy-bitcoins, or find a private bitcoin broker in italy (this is the safest option) as soon as you are ready to transfer I will give you a wallet

54. Message 054 From Victim Victim Date Not recorded

    ok do you know i can do with an atm and where i can find it and use it to give the money

55. Message 055 From Babuk Actor / other Date Not recorded

    https://coinatmradar.com/country/105/bitcoin-atm-italy/

56. Message 056 From Victim Victim Date Not recorded

    ok thanks

57. Message 057 From Victim Victim Date Not recorded

    we have some questions

58. Message 058 From Victim Victim Date Not recorded

    1) is it ok for you if they proceed via coin ATM? Do you know if they can directly transfer funds to your wallet via the ATM, or do they need to purchase coins and them separately transfer them?

59. Message 059 From Victim Victim Date Not recorded

    2) once the decryption process begins, they obviously need some form of warranty that everything is working. As for what we could see, your software encrypted files, destroyed filesystem shadow copies and compromised backups. What kind of technical warranty can you provide that everything will work smoothly even for big files (full VM disks) and LAN backup?

60. Message 060 From Victim Victim Date Not recorded

    and 3) given that we have an agreement, could you delete the post you published [redacted]? this would prevent the company from having to move on with legal procedures, which they are legally compelled to follow if they have notice of a data breach. if you delete that post, there will no longer be any evidence, and they will be able to avoid this.

61. Message 061 From Babuk Actor / other Date Not recorded

    1) For ATM, you'd better top up your wallet and then send us 2) File size doesn't matter, we made all required tests before encrypt your network

62. Message 062 From Babuk Actor / other Date Not recorded

    3) post will be removed today

63. Message 063 From Babuk Actor / other Date Not recorded

    The decryptor works the same as the encryptor only in the other direction

64. Message 064 From Victim Victim Date Not recorded

    ok thanks, we'll start with the work

65. Message 065 From Babuk Actor / other Date Not recorded

    During the day, the moderator of [redacted] will delete the topic, I wrote him a private message and also wrote in the topic, you can check it

66. Message 066 From Victim Victim Date Not recorded

    thank you, we will get back to you soon

67. Message 067 From Babuk Actor / other Date Not recorded

    ok

68. Message 068 From Victim Victim Date Not recorded

    ok thanks

69. Message 069 From Babuk Actor / other Date Not recorded

    threads [redacted] -deleted, please cheked

70. Message 070 From Victim Victim Date Not recorded

    Cheked, thanks! we are buying the btc. I'll ping you asap

71. Message 071 From Victim Victim Date Not recorded

    hi

72. Message 072 From Babuk Actor / other Date Not recorded

    Hello, when you will have required amount of bitcoin's write here

73. Message 073 From Victim Victim Date Not recorded

    yes

74. Message 074 From Babuk Actor / other Date Not recorded

    You ready to pay?

75. Message 075 From Victim Victim Date Not recorded

    not yet, we are buying

76. Message 076 From Babuk Actor / other Date Not recorded

    Okay, what date should I expect to be paid?

77. Message 077 From Victim Victim Date Not recorded

    Wednesday please

78. Message 078 From Babuk Actor / other Date Not recorded

    Okey

79. Message 079 From Babuk Actor / other Date Not recorded

    Any dialogues with us only in this chat, any other email and etc contacts are invalid

80. Message 080 From Victim Victim Date Not recorded

    Hi, sure!

81. Message 081 From Victim Victim Date Not recorded

    Hi, sure!

82. Message 082 From Victim Victim Date Not recorded

    hello

83. Message 083 From Babuk Actor / other Date Not recorded

    Hello, how your progress?

84. Message 084 From Victim Victim Date Not recorded

    We will have a call at 2 pm to understand the progress

85. Message 085 From Victim Victim Date Not recorded

    i'll update you

86. Message 086 From Babuk Actor / other Date Not recorded

    okey

87. Message 087 From Victim Victim Date Not recorded

    sorry only a question

88. Message 088 From Victim Victim Date Not recorded

    we can decrypt file by file too?

89. Message 089 From Victim Victim Date Not recorded

    with your tool?

90. Message 090 From Babuk Actor / other Date Not recorded

    our tool decrypt full pc

91. Message 091 From Babuk Actor / other Date Not recorded

    Unlocker decrypt full network

92. Message 092 From Victim Victim Date Not recorded

    FYi we did a revolut account and tomorrow we will have the btc

93. Message 093 From Victim Victim Date Not recorded

    so in the afternoom we can do it

94. Message 094 From Babuk Actor / other Date Not recorded

    Well, as soon as you are ready to transfer money, write to us, you will give you a new link to the chat, where we will conduct the transaction, it will be better for your safety and anonymity

95. Message 095 From Victim Victim Date Not recorded

    ok thanks

96. Message 096 From Victim Victim Date Not recorded

    sorry do you have an account revolut? because who bought the btc didn't know that you can not move it to an external wallet ( out the revolut platform )

97. Message 097 From Babuk Actor / other Date Not recorded

    No, but I do not think that you will have any problems with the transfer, you should be able to transfer to any bitcoin wallet

98. Message 098 From Victim Victim Date Not recorded

    i check now, because maybe with revolut you can send only to an revolut account

99. Message 099 From Babuk Actor / other Date Not recorded

    You will need to somehow solve this problem, and be able to transfer to any bitcoin wallet

100. Message 100 From Victim Victim Date Not recorded

     yes we do

101. Message 101 From Babuk Actor / other Date Not recorded

     admin:https://www.reddit.com/r/BitcoinUK/comments/7gv9ia/revolut_will_not_allow_you_to_send_purchased/

102. Message 102 From Victim Victim Date Not recorded

     yes we saw, we are finding a solution

103. Message 103 From Victim Victim Date Not recorded

     please send us another link by mail

104. Message 104 From Victim Victim Date Not recorded

     to chat

105. Message 105 From Babuk Actor / other Date Not recorded

     Please give your email address in the company's domain @ [redacted].com there we will send a new link to the chat, you will need to restart your browser and follow the link

106. Message 106 From Babuk Actor / other Date Not recorded

     so we can verify that you are indeed on behalf of [redacted] and the correspondence is confidential