Gomasom is a type of malware that encrypts your files and demand a ransom payment to decrypt them. This ransomware is a variant of the Gomasom family, which first appeared in early 2019. Attackers distribute Gomasom ransomware through spam emails, malicious websites, and exploit kits.

Stages of infection

There are three stages of Gomasom Ransomware infection:

1. Encryption: Gomasom will encrypt your files using a strong encryption algorithm. It will then append the “.gomasom” extension to the encrypted files and display a ransom note that includes instructions on how to pay the ransom and decrypt your files.
2. Ransom payment: Gomasom ransomware demands a ransom of 0.5 Bitcoin to decrypt your files. The price doubles if you don’t pay within 72 hours. Gomasom instructs victims to download and install a Bitcoin wallet, such as Electrum or Armory, and then send the Bitcoin to a specific address. Once the payment is made, Gomasom promises to provide victims with instructions on how to decrypt their files.
3. Decryption: Gomasom ransomware includes a unique ID number in the ransom note. This ID number is used to identify your computer and encrypted files. Once the ransom is paid, Gomasom will send you instructions on how to decrypt your files using this ID number.

However, there is no guarantee that Gomasom will provide you with the decryption key or that the decryption key will work. Therefore, we do not recommend paying the ransom.

What encryption algorithm does Gomasom use?

Gomasom ransomware uses the AES-256 encryption algorithm to encrypt your files. This is a strong encryption algorithm that makes it very difficult to decrypt files without the decryption key.

Protection

There are several things you can do to protect yourself from Gomasom and other types of malware:- Keep your operating system and software up to date. Regularly install security updates and patches for your operating system, web browser, and other software.- Use a reputable antivirus program with active real-time protection. This will help block malicious files and websites that could infect your computer.- Be cautious when opening email attachments. Don’t open email attachments from unknown senders or that look suspicious.- Don’t click on links in email messages or instant messages from unknown senders.- Be careful what you download from the Internet. Only download files from trusted websites. Someone often distributes Gomasom ransomware through fake downloads, such as pirated software or cracks for software programs.- Back up your important files regularly. This will help you recover your files if attackers infected your computer with any ransomware.

What types of files does Gomasom ransomware encrypt?

Gomasom encrypts:- Microsoft Office documents- PDFs- Images- Videos- Databases

Ransom note:

All of your important files have been encrypted!To decrypt them, you must pay a ransom of 0.5 Bitcoin.You have 72 hours to make the payment, after which the price will double.To make the payment, you must download and install a Bitcoin wallet, such as Electrum or Armory.Once you have installed a wallet, send the 0.5 Bitcoin to the following address:1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNaOnce the payment has been made, send an email to gomasomsupport@protonmail.com with your unique ID number and we will provide you with instructions on how to decrypt your files.Your ID number is: GOMASOM-ID-XXXX

What should you do?

If they have infected you with Gomasom ransomware, the first thing you should do is disconnect your computer from the internet to prevent the ransomware from encrypting any more files. You should then create a backup of your encrypted files and format your hard drive. Once you have done this, you can reinstall your operating system and restore your files from backup. If you do not have a backup, you can try using a file recovery program to recover your files.We built SalvageData data recovery software to help you.

Is there a public decryption tool?

Emsisoft released a free decryption tool for Gomasom ransomware on their website. This tool can decrypt files encrypted by Gomasom ransomware if you have a file that was encrypted with the “.gomasom” extension and a file that was not encrypted.Click here to download Gomasom decryptor.

Contact a data recovery service

If you cannot decrypt your files using the Gomasom decryptor, you can try contacting a data recovery service. Data recovery services specialize in recovering data from ransomware-encrypted computers and may be able to recover your files.SalvageData is a data recovery service that offers free quotes for Gomasom ransomware victims. Click here to contact us. We can get your life back to normal.