EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Ranking: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
|Threat Level:||100 % (High)|
|First Seen:||April 27, 2016|
|Last Seen:||November 11, 2022|
The Nemucod-AES Ransomware is an Updated Version of Another Threat
As soon as the Nemucod-AES Ransomware infects a computer, it will report on the infected computer to its Command and Control server. Some of the information that the Nemucod-AES Ransomware will gather and report about is the infected computer's Windows operating system version, the infected computer's IP address, the BIOS version and type of the infected PC, configuration and security settings, and whether or not a debugger is present on the infected computer. The Nemucod-AES Ransomware will relay this information to its Command and Control servers, which seem to be hosted on the following IP addresses as of the writing of this report:
It is likely that these servers will continue to change the IP addresses as known IP addresses related to the Nemucod-AES Ransomware become blocked by security software. In its attack, the Nemucod-AES Ransomware will use an encryption algorithm to make the victim's files inaccessible. The Nemucod-AES Ransomware uses the AES 256 encryption to make the victim's files inaccessible.
How Con Artists Use the Nemucod-AES Ransomware to Profit
After the Nemucod-AES Ransomware has finished encrypting the victim's files, it will display a ransom note on the victim's desktop. The Nemucod-AES Ransomware takes the victim's files hostage. The Nemucod-AES Ransomware displays a JPEG and a TXT version of its ransom note, on a document with the name 'Decrypt.txt,' which is dropped on the infected computer's desktop. The Nemucod-AES Ransomware also will change the infected computer's desktop image into a ransom note displayed over a red background. The Nemucod-AES Ransomware's ransom note contains the following text:
All your documents, photos, databases and other important personal files were encrypted using a combination of strong RSA-2048 and AES-128 algorithms.
The only way to restore your files is to buy decryptor. Please, follow these steps:
1. Create your Bitcoin wallet here:
2. Buy 0.11471 bitcoins here:
3. Send 0.11471 bitcoins to this address:
4. Open one of the following links in your browser:
5. Download and run decryptor to restore your files.
You can find this instruction in "DECRYPT" file on your desktop.'
Dealing with a Nemucod-AES Ransomware Infection
Malware analysts advocate against paying the Nemucod-AES Ransomware ransom, which currently is close to $290 USD at the current BitCoin exchange rate. The people responsible for the Nemucod-AES Ransomware may ignore the victims' payments and, furthermore, paying these ransoms merely allows these people to continue creating and distributing threats like the Nemucod-AES Ransomware by financing their activities. Instead of paying the Nemucod-AES Ransomware ransom, they should take preventive measures. Threat experts advise computer users to have file backups. Having backup copies of their files will make them immune to attacks like the Nemucod-AES Ransomware since the extortionists lose any power they have to demand a ransom payment if the victim is capable of restoring any of the compromised files from a backup copy.
SpyHunter Detects & Remove Nemucod-AES Ransomware
File System Details
Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.