Rumba Ransomware

The Rumba Ransomware is an encryption ransomware Trojan. The Rumba Ransomware is a variant of the STOP Ransomware, an encryption ransomware Trojan observed previously. The Rumba Ransomware is being distributed through bogus software downloads, often distributed through torrents and peer-to-peer file sharing networks. Once installed, the Rumba Ransomware is designed to take the victim's files hostage, making them inaccessible to justify the request fora ransom payment from the victim.

No One wants to Dance this Rumba Style

The main purpose of the Rumba Ransomware is to extract a ransom payment from the victim. The Rumba Ransomware uses a strong encryption algorithm in its attack to make the user-generated files unusable, targeting files such as those with the following file extensions:

.jpg, .jpeg, .raw, .tif, .gif, .png, .bmp, .3dm, .max, .accdb, .db, .dbf, .mdb, .pdb, .sql, .dwg, .dxf, .cpp, .cs, .h, .php, .asp, .rb, .java, .jar, .class, .py, .js, .aaf, .aep, .aepx, .plb, .prel, .prproj, .aet, .ppj, .psd, .indd, .indl, .indt, .indb, .inx, .idml, .pmd, .xqx, .xqx, .ai, .eps, .ps, .svg, .swf, .fla, .as3, .as, .txt, .doc, .dot, .docx, .docm, .dotx, .dotm, .docb, .rtf, .wpd, .wps, .msg, .pdf, .xls, .xlt, .xlm, .xlsx, .xlsm, .xltx, .xltm, .xlsb, .xla, .xlam, .xll, .xlw, .ppt, .pot, .pps, .pptx, .pptm, .potx, .potm, .ppam, .ppsx, .ppsm, .sldx, .sldm, .wav, .mp3, .aif, .iff, .m3u, .m4u, .mid, .mpa, .wma, .ra, .avi, .mov, .mp4, .3gp, .mpeg, .3g2, .asf, .asx, .flv, .mpg, .wmv, .vob, .m3u8, .dat, .csv, .efx, .sdf, .vcf, .xml, .ses, .qbw, .qbb, .qbm, .qbi, .qbr , .cnt, .des, .v30, .qbo, .ini, .lgb, .qwc, .qbp, .aif, .qba, .tlg, .qbx, .qby , .1pa, .qpd, .txt, .set, .iif, .nd, .rtp, .tlg, .wav, .qsm, .qss, .qst, .fx0, .fx1, .mx0, .fpx, .fxr, .fim, .ptb, .ai, .pfb, .cgn, .vsd, .cdr, .cmx, .cpt, .csl, .cur, .des, .dsf, .ds4, , .drw, .eps, .ps, .prn, .gif, .pcd, .pct, .pcx, .plt, .rif, .svg, .swf, .tga, .tiff, .psp, .ttf, .wpd, .wpg, .wi, .raw, .wmf, .txt, .cal, .cpx, .shw, .clk, .cdx, .cdt, .fpx, .fmv, .img, .gem, .xcf, .pic, .mac, .met, .pp4, .pp5, .ppf, .nap, .pat, .ps, .prn, .sct, .vsd, .wk3, .wk4, .xpm, .zip, .rar.

The Rumba Ransomware marks the compromised files by adding the file extension '.rumba' to the end of the file's name. The Rumba Ransomware delivers a text file to the victim's computer after carrying out its attack. This text file is named '_openme.txt' and contains the following message:

'ALL YOUR FILES ARE ENCRYPTED

Your personal ID:
[random characters]'

However, paying the Rumba Ransomware ransom or contacting the criminals responsible for the Rumba Ransomware attack may not bring your files back.

Protecting Your Data from Threats Like the Rumba Ransomware

The best protection against threats like the Rumba Ransomware is to have backup copies of your files. Apart from file backups, it is necessary to have an updated security program to help recover from a Rumba Ransomware infection. Since the Rumba Ransomware is commonly delivered through bogus software downloads, it is crucial to only obtain software from trusted, official sources.