The Rumba Ransomware is a part of the STOP Ransomware family, which means victims of this particular file-encryption Trojan will not be able to rely on free decryption software to assist them with the recovery of their files. The payload of the Rumba Ransomware may be distributed via phishing emails, fake downloads, and pirated software or media – this means that it would be in your best interest to be more careful when browsing the content of this sort. When the Rumba Ransomware starts it may work in the background to lock documents, images, videos, archives, databases, and other file formats. All encrypted files are recognizable easily thanks to the ‘.rumba’ extension that will be added after the original file extension (e.g. ‘archive.zip’ would be renamed to ‘archive.zip.rumba.’)

The ransom note is delivered when the Rumba Ransomware is done with the file-encryption task, and it is stored in the file ‘_openme.txt.’ The Rumba Ransomware uses the contact details [email protected] and [email protected], which were already seen in other versions of the STOP Ransomware.

We advise victims of the Rumba Ransomware not to take any rash decisions since this might easily get them involved in a fraudulent scheme whose purpose is to take their money. The authors of the Rumba Ransomware offer to sell a decryption tool in exchange for some Bitcoin, but this offer is a suspicious one and you should not agree to pay them the $490 they demand.

Unfortunately, the free recovery option is not guaranteed to help you get your files back – some 3rd-party data restoration software might be able to undo some of the damage, but a full recovery is out of the question usually. Do not forget that before you try to get your files back you should make sure to use a trustworthy antivirus product that will dispose of the Rumba Ransomware’s files.
[template:aliases][template:removal][template:technical_title][template:files][template:registry][template:additional]