How to remove Rubina5 ransomware virus

Rubina5 ransomware refers to the notorious Globe Imposter 

Rubina5 virus is a new sample of crypto-malware. Its activity is still quite low at the moment. Unfortunately, the malware encrypts data and attaches .rubina5 file extension. Regarding the specifications, the malware suggests a possible relation to the Globe Imposter virus^[1] family. On the other hand, the @aol.com is used by Dharma ransomware group as well.

The virus does not seem to have its GUI as it drops HOW_TO_DECRYPT_FILES.txt file. Here is the content of the message:

Attention! All your files are encrypted!
To recover your files and access them,
Send 0.015 Bitcoin (BTC) to the purse:
1Hu5cz8ZayEj6bG94C7i4hhwLU3MHdDCn
For decoding, please contact us by e-mail: s.holteman@aol.com
You have 5 attempts to enter the code. If this is exceeded
quantities, all data will irreversibly deteriorate. Be
careful when entering the code!

There is little information about what specific cipher is used to encode the data, or what specific distribution channels prevail. Therefore, it is unwise to rush paying the ransom without making sure that the fraudsters will send the decryption key. In short, it would be wiser to focus on Rubina5 removal. FortectIntego or MalwarebytesMalwarebytes might be of use in this situation.

Malware distribution peculiarities

Considering the relation to Globe Imposter, Rubina5 hijack might occur if users click on an infected link in corrupted domains. Alternatively, Nemucod trojan^[2] was spotted assisting the distribution network of the latter.

Malspam is another popular method to lure gullible users into a trap. You should be especially careful reviewing emails sent by supposed official institutions. Such email might only include a few lines suggesting to check the information in the attached invoice or package delivery notification. In order not to get reduce the limit of the infection. You might reduce the risk of ransomware if you follow these steps:

• update the browser, security apps, and OS once the updates are issues
• do not download Flash Player update in random sources
• avoid downloading content from trojan-sharing sites
• verify the sender’s identity before opening the email attachment
• back up your files and store the copies in different locations

Now let us look through the options how to remove Rubina5 virus.

Start Rubina5 elimination process

If the virus is indeed related to the Globe Imposter, it might be just one of the multiple versions which wane out after the appearance. If you failed to escape this virtual misfortune, it is necessary to eliminate the virus. You can remove Rubina5 virus with the assistance of malware elimination tool. If it does not respond or crashes, reboot the system in Safe Mode.

After that, complete Rubina5 removal. You may also find some of our recommended data recovery tools useful if you did not create a backup in advance. Bear in mind that this malware may wander not only in English domains but in Hungarian, Danish or Japanese^[3] sites.