Home Malware Programs Ransomware GO Ransomware

GO Ransomware

Posted: May 3, 2017

Threat Metric

Threat Level: 10/10
Infected PCs: 26
First Seen: May 3, 2017
Last Seen: November 28, 2019
OS(es) Affected: Windows


The Go Ransomware is a threat that locks up files on affected computers and asks for a ransom to be provided with a decryption key. The ransom note is written in Czech, and it is located in a file named 'precist.html.' This ransomware appends the extension '.LOCKED' to the encrypted files, and it uses strong AES and RSA encryption algorithms.

Each victim receives a unique ID number, which also is contained in the ransom note. The amount of the requested ransom is 0.05 Bitcoin and the operators of the malware claim that the user's files would be decrypted automatically as soon as the ransom is received. The Go Ransomware also is called the JoeGo Ransomware by some cybersecurity researchers. So far, it is known that this ransomware threat spreads through the following URL: 'nebezpecnyweb.eu/dl/m.'

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\msguard.exe File name: msguard.exe
Size: 6.71 MB (6716416 bytes)
MD5: 02be4e542a77319c28511abcfb126c4b
Detection count: 19
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
Group: Malware file
Last Updated: November 27, 2019

Related Posts

Loading...