Nemucod-AES Ransomware

Nemucod-AES Ransomware Description

Type: Ransomware

The Nemucod-AES Ransomware is a variant of Nemucod, a ransomware Trojan that has been active since at least August of 2016. Malware researchers observed this new version of the old ransomware Trojan on June 30, 2017. The Nemucod-AES Ransomware may be delivered to victims through corrupted spam email attachments, which may take the form of email messages that include a corrupted attached file that uses bad scripts to infect the victim's computer. A typical example of this is a fake UPS delivery invoice file named 'UPS-Delivery-005156577.doc.js.' Note the JS extension, which is added after the DOC extension. By using a double extension and an icon for the file that impersonates the default icon for DOC files, con artists can trick computer users into downloading and executing corrupted JavaScript files and similar content that they would avoid normally.

The Nemucod-AES Ransomware is an Updated Version of Another Threat

As soon as the Nemucod-AES Ransomware infects a computer, it will report on the infected computer to its Command and Control server. Some of the information that the Nemucod-AES Ransomware will gather and report about is the infected computer's Windows operating system version, the infected computer's IP address, the BIOS version and type of the infected PC, configuration and security settings, and whether or not a debugger is present on the infected computer. The Nemucod-AES Ransomware will relay this information to its Command and Control servers, which seem to be hosted on the following IP addresses as of the writing of this report:

  • 118.44.99.208
  • 128.172.195.141
  • 161.178.56.125
  • 187.9.125.102
  • 19.226.208.209
  • 218.33.235.57
  • 223.246.43.6
  • 50.39.219.180
  • 65.194.82.52
  • 73.112.104.144
  • 75.60.48.226

It is likely that these servers will continue to change the IP addresses as known IP addresses related to the Nemucod-AES Ransomware become blocked by security software. In its attack, the Nemucod-AES Ransomware will use an encryption algorithm to make the victim's files inaccessible. The Nemucod-AES Ransomware uses the AES 256 encryption to make the victim's files inaccessible.

How Con Artists Use the Nemucod-AES Ransomware to Profit

After the Nemucod-AES Ransomware has finished encrypting the victim's files, it will display a ransom note on the victim's desktop. The Nemucod-AES Ransomware takes the victim's files hostage. The Nemucod-AES Ransomware displays a JPEG and a TXT version of its ransom note, on a document with the name 'Decrypt.txt,' which is dropped on the infected computer's desktop. The Nemucod-AES Ransomware also will change the infected computer's desktop image into a ransom note displayed over a red background. The Nemucod-AES Ransomware's ransom note contains the following text:

'ATTENTION!
All your documents, photos, databases and other important personal files were encrypted using a combination of strong RSA-2048 and AES-128 algorithms.
The only way to restore your files is to buy decryptor. Please, follow these steps:
1. Create your Bitcoin wallet here:
xxxxs://blockchain.info/wallet/new
2. Buy 0.11471 bitcoins here:
https://localbitcoins.com/buy_bitcoins
3. Send 0.11471 bitcoins to this address:
<%ADDRESS%>
4. Open one of the following links in your browser:
xxxx://elita5.md/counter/71GCn9vz73FNDmoVxgxXqjo7dSXyLmfnTDt
xxxx://artdecorfashion.com/counter/71GCn9vz73FNDmoVxgxXqjo7dSXyLmfnTDt
xxxx://goldwingclub.ru/counter/71GCn9vz73FNDmoVxgxXqjo7dSXyLmfnTDt
xxxx://perdasbasalti.it/counter/71GCn9vz73FNDmoVxgxXqjo7dSXyLmfnTDt
xxxx://natiwa.com/counter/71GCn9vz73FNDmoVxgxXqjo7dSXyLmfnTDt
5. Download and run decryptor to restore your files.
You can find this instruction in "DECRYPT" file on your desktop.'

Dealing with a Nemucod-AES Ransomware Infection

Malware analysts advocate against paying the Nemucod-AES Ransomware ransom, which currently is close to $290 USD at the current BitCoin exchange rate. The people responsible for the Nemucod-AES Ransomware may ignore the victims' payments and, furthermore, paying these ransoms merely allows these people to continue creating and distributing threats like the Nemucod-AES Ransomware by financing their activities. Instead of paying the Nemucod-AES Ransomware ransom, they should take preventive measures. Threat experts advise computer users to have file backups. Having backup copies of their files will make them immune to attacks like the Nemucod-AES Ransomware since the extortionists lose any power they have to demand a ransom payment if the victim is capable of restoring any of the compromised files from a backup copy.

Technical Information

Screenshots & Other Imagery

SpyHunter Detects & Remove Nemucod-AES Ransomware

File System Details

Nemucod-AES Ransomware creates the following file(s):
# File Name MD5 Detection Count
1 c0fde8fd84767083f1facce2c3cc5316.exe c0fde8fd84767083f1facce2c3cc5316 92
2 a2.exe 4d0f490e3e21bef1c6f0c6fa93de90ed 44
3 nuke.jse f6e251aefb5d094c71511c4210fe9fcd 2
4 file.js ba44cb88fb6b3d68a0198ad29ad9f27b 0
More files

Registry Details

Nemucod-AES Ransomware creates the following registry entry or registry entries:
Directory
%LOCALAPPDATA%\Upkfmedia
Regexp file mask
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\adobe[RANDOM CHARACTERS]upd.jse
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\def.jse
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\fb.jse
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\mn.jse
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\nuke.jse
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\skype_upd.jse
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\xer64x.jse

Site Disclaimer

Enigmasoftware.com is not associated, affiliated, sponsored or owned by the malware creators or distributors mentioned on this article. This article should NOT be mistaken or confused in being associated in any way with the promotion or endorsement of malware. Our intent is to provide information that will educate computer users on how to detect, and ultimately remove, malware from their computer with the help of SpyHunter and/or manual removal instructions provided on this article.

This article is provided "as is" and to be used for educational information purposes only. By following any instructions on this article, you agree to be bound by the disclaimer. We make no guarantees that this article will help you completely remove the malware threats on your computer. Spyware changes regularly; therefore, it is difficult to fully clean an infected machine through manual means.