NRCL Ransomware
The NRCL Ransomware is malware designed specifically to take users' files as hostages and then demand the payment of a ransom for their restoration. Ransomware threats typically employ uncrackable encryption algorithms to ensure that the files they affect cannot be unlocked without the decryption key possessed by the attackers. However, certain aspects of the NRCL Ransomware point towards the currently deployed versions being used for testing purposes. As a result, affected users may be stuck with no way of restoring their data.
NRCL Ransomware's Details
As part of its threatening actions, the threat appends '.NRCL' as a new extension to the names of the locked files. It also drops an executable file named 'NRCL_Decryptor.exe' and a text file - 'Note.txt' on the breached device. The text file contains a shorter version of the ransom note displayed when the .exe file is launched.
According to the instructions, victims who wish to recover their files must pay a ransom of $300. To get additional details, such as how to transfer the funds, users are supposed to contact the email provided in the message. However, the current ransom notes do not contain a valid email address (test.test@gmail.com). No alternate ways to contact the attackers are mentioned.
The ransom message displayed by NRCL's executable file is:
'Software Tool
NRCL_DecryptorQ: Can I Recover My PC?
A: Sure. But you must pay $300.
Q: How Do I Pay?
A: Please send e-mail: test.test@gmail.com.//Rules\
DO NOT RESTART OR SHUTDOWN YOUR COMPUTER.
DO NOT DELETE MALWARE FILES.
YOU MUST DISABLE YOUR ANTIVIRUS.
DO NOT CLOSE THIS WINDOW.
IF YOU BREAK THESE RULES, YOU CANNOT DECRYPTING YOUR FILES!Your Personal Key: -
Please Type Your Decrypt KeyThe text file contains the following message:
Q: What happened to My Computer?
A: Your Computer was locked by NRSC.exe.
Q: Can I Recover My PC?
A: Sure. But you must pay $300.
Q: How Do I Pay?
A: Please send e-mail: test.test@gmail.com.'
