CXK-NMSL Ransomware

The CXK-NMSL Ransomware is a file-locker Trojan that blocks your PC's files with encryption. The CXK-NMSL Ransomware isn't a member of a Ransomware-as-a-Service family but does ask for a ransom, albeit in a currency that's specific to a Chinese streaming media website. Users should back up their work for a safe recovery under any circumstances and apply anti-malware tools whenever deleting the CXK-NMSL Ransomware is necessary.

A Different Coin for a Familiar-Looking Trojan

File-locking Trojans tend to avoid government-backed currencies and most, secure financial services when collecting their ransoms. Criminal businesses like the Ransomware-as-a-Service industry's Scarab Ransomware and the Crysis Ransomware families prefer Bitcoins and cryptocurrencies like it, while others might ask for vouchers or wire transfers. The CXK-NMSL Ransomware, a China-based Trojan, is asking for something even stranger – currency for a video-sharing site.

The CXK-NMSL Ransomware's opening attacks are a minor modification of a payload from a BAT-based Trojan (referred to by ID Ransomware as 'BAT Ransomware', although it isn't the same Trojan as the similar-named one from the Crysis Ransomware family). It encrypts a small number of media formats, such as Word documents, Excel spreadsheets, ZIP archives, and design files for AutoCAD and other drawing programs. It also gives them different extensions, using the string from its name.

After that, the CXK-NMSL Ransomware creates a TXT file with Chinese-language ransom instructions. The text asks for Bilibili.com coins, or B-coins, instead of the traditional cryptocurrency. It also demands that the victim watch a video and provide screenshots as proof of doing so. Bilibili is a Chinese site that provides streaming services for media and gaming and has a noted thematic emphasis on 'nerd culture' topics, such as anime.

Taking Geek Culture Back from the Black Hats

Although many elements of the CXK-NMSL Ransomware are unusual, its region of operation, and the threat actor's likely residing in the same area, explain most of the discrepancies between it and the rest of the file-locking Trojan sector. Samples that malware experts have on hand don't attempt to disguise the CXK-NMSL Ransomware, which is a DOS batch file, rather than an EXE, and targets Windows systems. It's possible that the CXK-NMSL Ransomware is experimental and not prepared for a release against the public, as of late September.

Always back your media up to a second, safe device for protection against automatic encryption. Examples of safer locations include removable devices and various cloud and network-based solutions. Since the CXK-NMSL Ransomware is avoiding detection by many AV vendors, malware experts also see a reason for emphasizing updating anti-malware products against this threat. Outdated products may not remove the CXK-NMSL Ransomware before it begins locking your files.

A few coins and video watches might seem like a small price for getting your documents and work content back in your hands. However, it still is a price that's wholly unnecessary, as long as you take the step of taking care of your digital belongings before the worst happens to them.