Nemucod-AES Ransomware

The Nemucod-AES Ransomware is a variant of Nemucod, a ransomware Trojan that has been active since at least August of 2016. Malware researchers observed this new version of the old ransomware Trojan on June 30, 2017. The Nemucod-AES Ransomware may be delivered to victims through corrupted spam email attachments, which may take the form of email messages that include a corrupted attached file that uses bad scripts to infect the victim's computer. A typical example of this is a fake UPS delivery invoice file named 'UPS-Delivery-005156577.doc.js.' Note the JS extension, which is added after the DOC extension. By using a double extension and an icon for the file that impersonates the default icon for DOC files, con artists can trick computer users into downloading and executing corrupted JavaScript files and similar content that they would avoid normally.

The Nemucod-AES Ransomware is an Updated Version of Another Threat

As soon as the Nemucod-AES Ransomware infects a computer, it will report on the infected computer to its Command and Control server. Some of the information that the Nemucod-AES Ransomware will gather and report about is the infected computer's Windows operating system version, the infected computer's IP address, the BIOS version and type of the infected PC, configuration and security settings, and whether or not a debugger is present on the infected computer. The Nemucod-AES Ransomware will relay this information to its Command and Control servers, which seem to be hosted on the following IP addresses as of the writing of this report:

• 118.44.99.208
• 128.172.195.141
• 161.178.56.125
• 187.9.125.102
• 19.226.208.209
• 218.33.235.57
• 223.246.43.6
• 50.39.219.180
• 65.194.82.52
• 73.112.104.144
• 75.60.48.226

It is likely that these servers will continue to change the IP addresses as known IP addresses related to the Nemucod-AES Ransomware become blocked by security software. In its attack, the Nemucod-AES Ransomware will use an encryption algorithm to make the victim's files inaccessible. The Nemucod-AES Ransomware uses the AES 256 encryption to make the victim's files inaccessible.

How Con Artists Use the Nemucod-AES Ransomware to Profit

After the Nemucod-AES Ransomware has finished encrypting the victim's files, it will display a ransom note on the victim's desktop. The Nemucod-AES Ransomware takes the victim's files hostage. The Nemucod-AES Ransomware displays a JPEG and a TXT version of its ransom note, on a document with the name 'Decrypt.txt,' which is dropped on the infected computer's desktop. The Nemucod-AES Ransomware also will change the infected computer's desktop image into a ransom note displayed over a red background. The Nemucod-AES Ransomware's ransom note contains the following text:

'ATTENTION!
All your documents, photos, databases and other important personal files were encrypted using a combination of strong RSA-2048 and AES-128 algorithms.
The only way to restore your files is to buy decryptor. Please, follow these steps:
1. Create your Bitcoin wallet here:
xxxxs://blockchain.info/wallet/new
2. Buy 0.11471 bitcoins here:
https://localbitcoins.com/buy_bitcoins
3. Send 0.11471 bitcoins to this address:
<%ADDRESS%>
4. Open one of the following links in your browser:
xxxx://elita5.md/counter/71GCn9vz73FNDmoVxgxXqjo7dSXyLmfnTDt
xxxx://artdecorfashion.com/counter/71GCn9vz73FNDmoVxgxXqjo7dSXyLmfnTDt
xxxx://goldwingclub.ru/counter/71GCn9vz73FNDmoVxgxXqjo7dSXyLmfnTDt
xxxx://perdasbasalti.it/counter/71GCn9vz73FNDmoVxgxXqjo7dSXyLmfnTDt
xxxx://natiwa.com/counter/71GCn9vz73FNDmoVxgxXqjo7dSXyLmfnTDt
5. Download and run decryptor to restore your files.
You can find this instruction in "DECRYPT" file on your desktop.'

Dealing with a Nemucod-AES Ransomware Infection

Malware analysts advocate against paying the Nemucod-AES Ransomware ransom, which currently is close to $290 USD at the current BitCoin exchange rate. The people responsible for the Nemucod-AES Ransomware may ignore the victims' payments and, furthermore, paying these ransoms merely allows these people to continue creating and distributing threats like the Nemucod-AES Ransomware by financing their activities. Instead of paying the Nemucod-AES Ransomware ransom, they should take preventive measures. Threat experts advise computer users to have file backups. Having backup copies of their files will make them immune to attacks like the Nemucod-AES Ransomware since the extortionists lose any power they have to demand a ransom payment if the victim is capable of restoring any of the compromised files from a backup copy.

SpyHunter Detects & Remove Nemucod-AES Ransomware