IwasRansomed

encrypted file with extention .TABUFA

Recommended Posts

Need help finding decrypting tool for files encrypted with .TABUFA.  The download apparently came from a malware/adware from the KMplayer.  It was the only active program on my computer, and the date of the culprit malware aligns with when the ads appeared in the movie player.  Thanks in advance.

 

I added a text file with more information and the actual ransom note.

I also uploaded an encrypted file and the virus executable  where I renamed the extension to .e0e  to the link you provided.

Ransom-Note.txt

 

Share this post


Link to post
Share on other sites

I recommend uploading a copy of the ransom note along with an encrypted file to ID Ransomware so that you can verify which ransomware you are dealing with:
https://id-ransomware.malwarehunterteam.com/

You can paste a link to the results into a reply if you would like one of our experts to review them

Share this post


Link to post
Share on other sites

Since there was not given answer from the victim, it is important in any case not to leave the topic hanging on mid of word.

In the case of this Ransomware, antivirus engines may be mistaken. 

Most likely they will call it the GlobeImposter Ransomware, but this is most likely another Ransomware. Apparently, it has the code from GlobeImposter in order to mislead.

Service ID Ransomware id has recently also identified it as GlobeImposter.

We have collected various variants as part of the updates in the article Maoloa Ransomware

Demonslay335 only recently discovered that some variants are not GlobeImposter, but are defined as GlobeImposter.
This question still needs to be studied in detail and elaborated in detail, and there may be more such fake GlobeImposter.
Recently another fake GlobeImposter was found, for him I have a separate article and updates, but it does not apply to this topic.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.