Goba Ransomware Will Hold Your Files Hostage
Our team of malware experts came across Goba, a type of ransomware that uses encryption to restrict access to files by adding the ".goba" extension to encrypted filenames.
This ransomware belongs to the Djvu ransomware family and may be disseminated with other malware like RedLine or Vidar. Upon encrypting the files, Goba generates a ransom note titled "_readme.txt" that explains the situation and demands payment in exchange for decryption software and a unique key to recover the files. The cost of the decryption tool is $980, but the attacker offers a 50% discount if the victim contacts them within 72 hours.
The note also mentions that restoration of the files is impossible without payment, and the attacker provides two email addresses for communication. Furthermore, the attacker offers to decrypt one file for free as proof that they can restore the files. An example of how Goba changes filenames is that "1.jpg" becomes "1.jpg.goba" and "2.png" becomes "2.png.goba".
Goba's Ransom Note Asks for Modest Ransom
The full text inside the Goba ransom note goes as follows:
ATTENTION!
Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-rayImYlyWe
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:
support@freshmail.topReserve e-mail address to contact us:
datarestorehelp@airmail.ccYour personal ID:
There is nothing new here - the ransom note copies the usual Djvu format and pattern.
How Can You Protect Your Personal Data and Files from Ransomware like Goba?
Ransomware attacks like Goba can be devastating, but there are steps you can take to protect your personal data and files from such attacks. Here are some tips:
- Backup your data: Regularly backing up your files is the most effective way to protect yourself from ransomware. Make sure to backup your files to an external hard drive, cloud storage, or another secure location that is not connected to your computer.
- Use anti-malware software: Install anti-malware software on your computer and keep it up-to-date. This software can detect and block ransomware before it can infect your system.
- Keep your software up-to-date: Ensure that all your software, including your operating system, web browsers, and plugins, are up-to-date with the latest security patches. Outdated software can have vulnerabilities that ransomware can exploit.
- Be cautious of email attachments and links: Ransomware can be spread through phishing emails that include infected attachments or links. Be cautious of emails from unknown senders, and avoid clicking on links or downloading attachments from suspicious emails.
- Use strong passwords: Use strong, unique passwords for all your accounts and change them regularly. Consider using a password manager to generate and store complex passwords.
- Enable two-factor authentication: Enable two-factor authentication on all your accounts that support it. This provides an additional layer of security and can prevent unauthorized access to your accounts.
- Educate yourself: Stay informed about the latest ransomware threats and educate yourself on how to recognize and avoid them.
By following these tips, you can significantly reduce your risk of falling victim to ransomware attacks like Goba and protect your personal data and files.
