Home Malware Programs Ransomware Goliath Ransomware

Goliath Ransomware

Posted: May 19, 2016

Threat Metric

Threat Level: 8/10
Infected PCs: 105
First Seen: May 19, 2016
Last Seen: June 16, 2022
OS(es) Affected: Windows

The Goliath Ransomware is a threatening file encryptor. The Goliath Ransomware encodes your data automatically. Since the affected data becomes unreadable to all associated programs, any victims then may be tempted to pay the ransom sum that the Goliath Ransomware leverages against them, which, in theory, could deliver a decryption service. However, these 'premium' black market solutions are unreliable in comparison to safe alternatives, such as restoring from an uninfected backup. Before you do so, be sure to remove the Goliath Ransomware from your PC through standard anti-malware protocols.

Building Giants by Standing on an Old Threat's Shoulders

The 'Deep Web' that plays host to typically threatening websites avoiding being indexed by major search engines has close connections to the ongoing transactions of the threat industry. One aspect of such 'businesses' that their victims may not consider is the fact that many Trojan administrators have little or no coding knowledge, and must turn to other illicit entities for acquiring any functional threats. The control that a threat developer has in such scenarios shouldn't be underestimated, and is well-showcased in the hidden website for the Goliath Ransomware, a new file encryptor.

The Goliath Ransomware's authors claim to have built this threat from the '.locky File Extension' Ransomware's code, although there are no apparent samples in distribution for malware experts to confirm this claim. The same website also tips its hand too far by stating that this Trojan requires a high-quality graphics card potentially, which isn't an ordinary prerequisite for the payloads of file encryption Trojans. This discrepancy could be a sign that the Goliath Ransomware's authors are using the Trojan to double as a cryptocurrency miner on the side, potentially taking advantage of their clientele.

Besides the impact on its administrators, the Goliath Ransomware supposedly has all of the features included in its recent ancestor. The ransomware component of the program scans the victim's PC, isolating files of whitelisted formats, and encrypts them. After paying the admin's ransom (which traditionally is a Bitcoin transaction), the victims 'purchase' a decryptor that restores their files.

Finding a Fitting Sling Stone for a Goliath Ransomware Infection

The authors of the Goliath Ransomware's website emphasize the ease of use of this threat but hamper their marketing with an unprofessional presentation, suspicious technical details and extremely high fees for untested products. The Goliath Ransomware's very existence may be merely a way for one set of con artists to trick another set. However, harmful file encryption is a very real and active branch of the threat industry, albeit one that is mostly preventable with reasonable security standards.

Malware experts often see con artists failing to follow up their collected ransoms with functional decryptors, particularly from teams showing hallmarks of unprofessional programming behavior. Using the Goliath Ransomware's provided means of data restoration should be considered only as a final resort if your information is irreplaceable and valuable. PC owners who already have such information to protect might avail themselves of backup software and cloud storage services, either of which can put their files out of the reach of Trojans like the Goliath Ransomware.

These threats are known for deleting local backups and potentially blocking your use of other programs that could facilitate a full recovery. Remove the Goliath Ransomware through your anti-malware programs, using any additional means to gain access to such software, such as booting the system from your USB drive. With the Goliath Ransomware gone, you can recover your files at your leisure and with no third parties interference.

Loading...