Home Malware Programs Ransomware Nemucod-AES Ransomware

Nemucod-AES Ransomware

Posted: June 30, 2017

Threat Metric

Threat Level: 10/10
Infected PCs: 1,576
First Seen: April 27, 2016
Last Seen: May 3, 2023
OS(es) Affected: Windows

The Nemucod-AES Ransomware is a new variant of Nemucod, a family of Trojans dedicated to loading other threats previously that, later, transitioned into file-encrypting attacks. This Trojan uses a secure encryption algorithm to lock your files and, then, loads an image showing its demands for Bitcoins. Having external backups can keep threats of this classification from causing any permanent harm, and most anti-malware products should quarantine or delete the Nemucod-AES Ransomware as soon as they detect it.

Con Artists Busy Baby-Proofing Their Attacks

Threat actors trying to extort money have it in their best interest to lie about the dangers of not paying them loudly and frequently when it comes to recovering digital media especially. A routine facet of most file-encrypting Trojan campaigns is that they tend to show inaccurate information about the strength of their enciphering features, which are often, but not always, breakable with a little effort. Unfortunately, there now is one less in the membership of easily cracked threats, as the Nemucod Ransomware campaign is updating to the Nemucod-AES Ransomware.

Although the first versions of the Nemucod Ransomware are using a relatively simple, XOR-based attack to lock the files of their victims, the Nemucod-AES Ransomware is upgraded to use the AES-128 and RSA-2048. This means of enciphering documents, pictures, and other media can prevent you from opening them permanently, or until the remote attacker provides the decryption program. Unlike old variants of the same threat, the Nemucod-AES Ransomware is unbreakable by third-party decryptors effectively, without further bugs or mistakes from its threat actors.

Malware researchers also find the Nemucod-AES Ransomware using a minor variant of its older ransom note, which it loads in an image-based format and places on your desktop. The message asks for a small fraction of the Bitcoin currency to provide the download link for its decryptor, converting to just under 300 USD. Also of note is that the Nemucod-AES Ransomware retains its old, modular structure, instead of consisting of one executable, and will download its other components as needed.

The Mail that's not Worth Taking

The Nemucod-AES Ransomware attacks are targeting US victims in particular, with the infection method of choice being e-mail spam campaigns. Malware experts are finding forged messages carrying this threat's installer pretending to be UPS delivery notices, which could be suitable for compromising recreational users or business networks equally. Readers shouldn't forget that e-mail attachments are an in-vogue way for threat actors to circulate many kinds of threatening software, including file-encrypting Trojans.

The Nemucod-AES Ransomware benefits from layered defenses against old decryption methods, and having a backup that the Nemucod-AES Ransomware can neither encode nor delete is the easiest means of guaranteeing the safety of your media. Compromised PCs may show few or no symptoms until the data-locking attack concludes, although, afterward, the user may note such changes as new extensions on their files or a new desktop wallpaper. Anti-malware programs previously viable against the Nemucod family also can delete the Nemucod-AES Ransomware safely, and, hopefully, before it locks your content.

Just like money never truly stops flowing, money-making misdeeds never stop advancing and evolving. It's perilous to assume that the limitations of old Trojans will apply to the next release of the same program, as the Nemucod-AES Ransomware so well shows.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%LOCALAPPDATA%\Uxtqmedia\c0fde8fd84767083f1facce2c3cc5316.exe File name: c0fde8fd84767083f1facce2c3cc5316.exe
Size: 167.93 KB (167936 bytes)
MD5: c0fde8fd84767083f1facce2c3cc5316
Detection count: 215
File type: Executable File
Mime Type: unknown/exe
Path: %LOCALAPPDATA%\Uxtqmedia
Group: Malware file
Last Updated: February 14, 2020
%SystemDrive%\Users\<username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nuke.jse File name: nuke.jse
Size: 402.64 KB (402640 bytes)
MD5: e56ac7e5354df06673495d6da96cd8ef
Detection count: 90
Mime Type: unknown/jse
Path: %SystemDrive%\Users\<username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Group: Malware file
Last Updated: October 5, 2017
file.js File name: file.js
Size: 9.17 KB (9176 bytes)
MD5: ba44cb88fb6b3d68a0198ad29ad9f27b
Detection count: 80
File type: JavaScript file
Mime Type: unknown/js
Group: Malware file
Last Updated: May 3, 2017
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\nuke.jse File name: nuke.jse
Size: 401.95 KB (401957 bytes)
MD5: 2f4f06cb432169ccd4501596fe71758b
Detection count: 73
Mime Type: unknown/jse
Path: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
Group: Malware file
Last Updated: October 5, 2017
%SystemDrive%\Users\<username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nuke.jse File name: nuke.jse
Size: 390.3 KB (390309 bytes)
MD5: c1a3a310327493ac13baf4c2bf9ea353
Detection count: 34
Mime Type: unknown/jse
Path: %SystemDrive%\Users\<username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Group: Malware file
Last Updated: October 5, 2017
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\nuke.jse File name: nuke.jse
Size: 402.6 KB (402606 bytes)
MD5: ba6dd9e84b54273e553dfbce81a36b02
Detection count: 12
Mime Type: unknown/jse
Path: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
Group: Malware file
Last Updated: October 5, 2017
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\nuke.jse File name: nuke.jse
Size: 390.25 KB (390255 bytes)
MD5: 263e0c0575fde12adff9877f9fce5e59
Detection count: 9
Mime Type: unknown/jse
Path: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
Group: Malware file
Last Updated: October 5, 2017
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\nuke.jse File name: nuke.jse
Size: 410.74 KB (410744 bytes)
MD5: a980fbe6b297e8b576cd0a5e420dc229
Detection count: 9
Mime Type: unknown/jse
Path: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
Group: Malware file
Last Updated: October 5, 2017
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\nuke.jse File name: nuke.jse
Size: 394.8 KB (394807 bytes)
MD5: b4362a410bffbf4d71620c700c21f6cd
Detection count: 9
Mime Type: unknown/jse
Path: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
Group: Malware file
Last Updated: October 5, 2017
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\nuke.jse File name: nuke.jse
Size: 410.74 KB (410746 bytes)
MD5: 1b78a537744b7f9cdd1fe64ef1d82040
Detection count: 7
Mime Type: unknown/jse
Path: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
Group: Malware file
Last Updated: October 5, 2017
%SystemDrive%\Users\<username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nuke.jse File name: nuke.jse
Size: 390.8 KB (390802 bytes)
MD5: 256cc82c208d021d90b5a82cb0a62292
Detection count: 5
Mime Type: unknown/jse
Path: %SystemDrive%\Users\<username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Group: Malware file
Last Updated: October 5, 2017

Registry Modifications

The following newly produced Registry Values are:

Regexp file mask%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\adobe[RANDOM CHARACTERS]upd.jse%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\def.jse%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\fb.jse%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\mn.jse%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\nuke.jse%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\skype_upd.jse%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\xer64x.jse

Additional Information

The following directories were created:
%LOCALAPPDATA%\Upkfmedia
Loading...