Blm ransomware is a Dharma family cryptovirus that encrypts all files and demands money from its victims
Blm ransomware is malware that belongs to the widely known Dharma[1] ransomware family and became active in September 2020. It is similar to other analogs because it encrypts[2] user data with AES+RSA algorithm. If the victim wants to recover files, this virus demands a ransom in Bitcoin currency for the decryption.
Blm ransomware encrypts various files: pictures, videos, audio records, documents, etc. During the encryption process, all infected files get new .Blm extension and users can't open any of them.
Once encryption is done, the victim not only gets a text file named “FILES ENCRYPTED.txt” but also sees a pop-up window. Both of these serve exactly the same purpose, however – they explain that victims need to contact them via blacklivesmatter@qq.com and pay bitcoins for the decryption tool that could allegedly allow them to regain access to files.
| Name | Blm ransomware |
| Family | Dharma family |
| Type | File locking virus, cryptovirus, ransomware |
| Distribution | This malware comes from spam, infected email attachments, torrent websites, malicious ads, etc. |
| Issues | This virus is using an encryption algorithm to lock all personal data on the infected device. The victim can't open any encrypted file and cybercriminals demands to pay the ransom for the decryption |
| File extension | Each of the files gets .Blm extension. They are encrypted and cannot be opened or used without decryption |
| Ransom note | A file named FILES ENCRYPTED.html is dropped for victims to inform about virus behavior and possible steps to this problem. Also, the victims see a pop-up window. Hackers state that the only solution is to pay the ransom |
| File recovery | Data recovery might be impossible if you don't have backups but in some cases, official decryption tools or third-party programs recovery software can help |
| Malware removal | Remove Blm ransomware by scanning your device with a powerful anti-malware application. |
| System fix | Ransomware or other threats sometimes can cause serious damage to your device OS. In some cases, you will even need to reinstall it. To avoid that, we recommend fixing the virus damage with FortectIntego repair software |
The biggest misconception that victims have after being infected is that they can remove Blm ransomware extension and access their data again. Unfortunately, it is not the case, as a unique decryption key is required, and it is being held hostage by the attackers. While there is no guarantee to recover data without backups, we provide alternative solutions for data recovery below. Nonetheless, we recommend using SpyHunterCombo Cleaner or MalwarebytesMalwarebytes for the elimination of the infection and then fixing virus damage to the Windows system with repair tools such as FortectIntego.
As soon as the .Blm virus changes Windows settings and injects malicious entries, it delivers the ransom note. The text message that can be opened with Notepad or similar program explains:
'all your data has been locked us
You want to return?
Write email blacklivesmatter@qq.com.'
More information is presented in the pop-up window. Victims see a message with an e-mail address and recommendation to resend the letter to a different e-mail if they didn't receive a reply within 12 hours. While the ransom should be paid in Bitcoin cryptocurrency, the ransom size is not specified and depends on the various factors.
Also, cybercriminals try to lure victims to pay the ransom with decryption testing. Hackers will successfully decrypt up to 5 files if they are no bigger than 1MB and are not valuable (they won't help for large Excel sheets, backups, etc.). They send these files back to the victim of Blm ransomware because they want to demonstrate that the decryption is indeed possible.
The pop-up message also warns that the renaming corrupted files or/and trying to decrypt them with other tools won't help and the victim may lose all data permanently. The Blm virus ransom text displayed in the pop-up window looks like that:
All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail blacklivesmatter@qq.com
Write this ID in the title of your message –
In case of no answer in 24 hours write us to these e-mails:blacklivesmatter@qq.com
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files.
Free decryption as a guarantee
Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 10Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click ‘Buy bitcoins’, and select the seller by payment method and price.
https://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
http://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Criminals want your money but paying is not recommended
Unfortunately, in many cases, the cybercriminals are correct by saying that the only possible way to decrypt files is by paying hackers. But the recovery might be still possible if the virus has significant flaws. Also, the victim can recover important data if he/she has backups. Even if your computer is infected and you don't have your data backed in online servers or in other devices, cybersecurity experts[3] recommend against paying the criminals behind .Blm file virus.[4]
In some cases, victims still do not receive decryption tools even after the money transfer. So, users not only lose their files but money too. We recommend having backups, relying on reliable programs, and performing Blm ransomware removal instead.
Moreover, you should be very careful on the internet if you don't want to catch new ransomware in the future. In most cases, ransomware comes through spam campaigns, trojans, fake updaters, illegal activation tools, etc. You should avoid dubious downloads channels and always think before the installation of any new software. Untrustworthy sources like to contribute to spreading infections.
Remove Blm ransomware and rely on file-recovery options
If your device is infected we recommend you remove Blm ransomware. If you don't want to do it manually, you should use anti-malware software like such as SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. A reliable program will help you to detect and delete all threats on your computer.
Only after the Blm ransomware removal, you may try to recover your data from backups. But ransomware or other infections sometimes can cause serious damage to your computer OS. In some cases, you will even need to reinstall it. To avoid such inconvenient things to happen, we recommend fixing the Blm virus damage with FortectIntego repair tool.
After you remove Blm ransomware, you may try to recover your files. We recommend using the free decryption tool, third-party recovery solutions, or checking whether the automatic Windows backups were not deleted. Unfortunately, if none of the steps below help, there is no other way to recover encrypted data.
Was this guide helpful?
Be the first to comment