Locked Out: Goaq Ransomware and How to Protect Yourself

While analyzing malware samples from online threat databases, we identified Goaq, a member of the Djvu ransomware family. Goaq operates by encrypting files and adding the ".goaq" extension to encrypted file names. It also generates a ransom note named "_readme.txt."

For instance, "1.jpg" would be renamed to "1.jpg.goaq" and "2.png" to "2.png.goaq" after being encrypted by Goaq. It's important to note that Goaq could be spread in tandem with other malware, like RedLine or Vidar, as it is a member of the Djvu family.

The ransom note specifies that victims must purchase decryption software and a unique key to retrieve access to their files. If they get in touch with the attackers within 72 hours, they can purchase decryption tools for $490; otherwise, they will be required to pay the full sum of $980. The ransom note also includes two email addresses: support@freshmail.top and datarestorehelp@airmail.cc.

Additionally, the ransom note claims that one file, which contains no significant information, can be sent to the attackers before payment. This file will be decrypted for free as proof that they can recover the files.

Goaq Ransom Note Asks for a Thousand Dollars

The full text of the Goaq ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-rayImYlyWe
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

What is the Best Way to Protect Your System from Ransomware Similar to Goaq?

There are several effective ways to safeguard your system against ransomware, including Goaq, such as regularly backing up important files, installing reputable antivirus software, and being cautious of suspicious emails or downloads. It's also important to ensure that your operating system and all software are kept up-to-date with the latest security patches.

Additionally, adopting safe browsing habits and educating yourself on how to recognize and avoid phishing attacks can significantly reduce the risk of falling victim to ransomware.