EBAKA Ransomware (.EBAKA File) Removal

The Ebaka virus falls within the Phobos ransomware family. Ransomware of such sort encrypts all user’s data on the computer (photos, text files, excel tables, music, videos, etc) and appends its own extension to every file, creating the info.txt files in each directory which contains the encrypted files.

Ebaka virus: what is known so far?

☝️ Ebaka is a Phobos family ransomware virus.

The scheme of renaming is this: id[xxxxx].[contact-email].Ebaka. After the encryption, a file entitled, for example, “report.docx” will be changed to “report.docx.id[1E857D00-3323].[[email protected]].ebaka”.

In each folder that contains the encrypted files, a info.txt file will appear. It is a ransom money note. It contains information about the ways of contacting the racketeers and some other information. The ransom note usually contains instructions on how to purchase the decryption tool from the racketeers. You can obtain this tool after contacting [email protected] by email. That is it.

Ebaka Overview:

The info.txt document accompanying the Ebaka ransomware states the following:

!!!All of your files are encrypted!!!
To decrypt them send e-mail to this address: [email protected].
If we don\'t answer in 24h., send e-mail to this address: [email protected]

In the screenshot below, you can see what a folder with files encrypted by the Ebaka looks like. Each filename has the “.Ebaka” extension appended to it.

How did my computer get infected with Ebaka ransomware?

There are plenty of possible ways of ransomware injection.

There are currently three most exploited methods for evil-doers to have the Ebaka virus working in your digital environment. These are email spam, Trojan introduction and peer-to-peer networks.

• If you access your mailbox and see emails that look like familiar notifications from utility services providers, postal agencies like FedEx, web-access providers, and whatnot, but whose mailer is unknown to you, beware of opening those emails. They are most likely to have a malicious file attached to them. Therefore, it is even riskier to download any attachments that come with emails like these.
• Another thing the hackers might try is a Trojan virus model. A Trojan is a program that gets into your computer disguised as something else. For example, you download an installer for some program you want or an update for some program. However, what is unboxed turns out to be a harmful program that encrypts your data. Since the installation wizard can have any title and any icon, you have to make sure that you can trust the resource of the things you’re downloading. The best way is to use the software developers’ official websites.
• As for the peer-to-peer networks like BitTorrent or eMule, the danger is that they are even more trust-based than the rest of the Internet. You can never know what you download until you get it. Our suggestion is that you use trustworthy websites. Also, it is reasonable to scan the directory containing the downloaded objects with the anti-malware utility as soon as the downloading is done.

How to remove ransomware?

It is crucial to note that besides encrypting your data, the Ebaka virus will most likely deploy Vidar Stealer on your computer to seize your credentials to various accounts (including cryptocurrency wallets). That spyware can derive your credentials from your browser’s auto-filling data.

How to avert ransomware injection?

Ebaka ransomware has no endless power, so as any similar malware.

You can armour your PC from ransomware infiltration taking three easy steps:

• Ignore any emails from unknown senders with unknown addresses, or with content that has nothing to do with something you are waiting for (how can you win in a money prize draw without participating in it?). In case the email subject is more or less something you are expecting, check all elements of the questionable email with caution. A hoax email will surely have a mistake.
• Never use cracked or untrusted programs. Trojans are often distributed as a part of cracked products, possibly as a “patch” preventing the license check. Understandably, potentially dangerous programs are very hard to distinguish from reliable software, because trojans may also have the functionality you need. Try searching for information on this program on the anti-malware message boards, but the best solution is not to use such software.

FAQ

🤔 Are the “.Ebaka” files accessible?

Negative. That is why ransomware is so frustrating. Until you decode the “.Ebaka” files you will not be able to access them.

🤔 The encrypted files are very important to me. How can I decrypt them quickly?

Hopefully, you have made a copy of those important files. In case you haven’t, there is still a chance that you do have a Restore Point from some time ago to roll back the whole system to the moment when it had no virus yet, but already had your files. There are other ways to beat ransomware, but they take time.

🤔 What actions should I take if the Ebaka ransomware has blocked my computer and I can’t get the activation key.

🤔 What could help the situation right now?

Some of the encrypted files can be located elsewhere.

• If you exchanged your critical files by email, you could still download them from your online mailbox.
• You might have shared images or videos with your friends or relatives. Simply ask them to send those images back to you.
• If you have initially downloaded any of your files from the Internet, you can try to do it again.
• Your messengers, social networks pages, and cloud disks might have all those files as well.
• It might be that you still have the needed files on your old PC, a portable device, phone, external storage, etc.

HINT: You can employ file recovery utilities² to get your lost data back since ransomware blocks the copies of your files, deleting the original ones. In the video below, you can learn how to recover your files with PhotoRec, but be advised: you can do it only after you eradicate the virus with an antivirus program.

1. My files are encrypted by ransomware, what should I do now?
2. Here’s the list of Best Data Recovery Software Of 2023.