Nodera Ransomware

The Nodera Ransomware is a file-locking Trojan that runs off of the Node.js JavaScript runtime environment. Besides this unusual developmental choice, the Nodera Ransomware operates similarly to other Trojans of its kind by encrypting the user's media and demanding Bitcoins for a decryptor. Users can protect their work through appropriate backups and let their anti-malware products block or delete the Nodera Ransomware as they deem it necessary.

The Central Node of Your Upcoming Media Accessibility Problems

With families like Hidden Tear or the Globe Ransomware making up most of the file-locking Trojan 'industry,' it may surprise some readers that learn of the regular occurrence of independent equivalents. The Nodera Ransomware isn't the offspring of either a Ransomware-as-a-Service or a freeware project but does harbor some software dependencies. Unfortunately for the victims, its choices of developmental framework lead to its being exceptionally cross-compatible with different operating systems.

The Nodera Ransomware runs off of Node.JS, a JavaScript runtime environment. Although malware experts only can confirm Windows samples of the Nodera Ransomware, this choice makes porting it to macOS or Linux a reasonably simple task for the author. It displays typical characteristics in its installation components, such as randomly-named files that it hides in the user's profile folder and Registry entry-based persistence.

The Nodera Ransomware uses AES-256 and RSA for the encryption that converts files into 'locked' versions, as is true of most Trojans of its kind. Victims should note, however, that the RSA security it uses is different from the one it asserts in its HTML ransom note. The ransom-negotiating process also appears under development due to the threat actor's presumably forgetting to include a means of contacting him for providing the key, even though the Nodera Ransomware drops a theoretically functional unlocking component.

Shying Your Files Away from Threatening Scripts

The Nodera Ransomware is more suitable for targeting individual users on unprotected machines than enterprise-grade networks. It attacks file-holding directories such as the user's Pictures and Documents, and auto-terminates word-processing software for gaining access to any open files. It also deletes the Shadow Volume Copies – Windows' default backups. However, it contains none of the advanced traversal or anti-security features that malware experts see in more full-fledged Ransomware-as-a-Services.

The distribution models for the Nodera Ransomware are using victim-instigated means of infection. The Nodera Ransomware installers are circulating through compromised Web ad-serving networks (AKA 'malvertising'), as well as additional, corrupted HTA files. The second of these two attacks might use a disguise such as a fake resume for infiltrating a company's server or an update pop-up on websites. The Trojan is live and fully capable of blocking files; unfortunately, its in-development elements only cause issues with the intended ransoming business model, not the encryption.

Victims should have backups of any media, such as documents, for protecting it from the Nodera Ransomware infections, which target multiple drives. Traditional anti-malware solutions also can provide appropriate defenses by deleting the Nodera Ransomware on sight.

Although the Nodera Ransomware asks for Bitcoins, its wallet is empty – and that's not much of a surprise, considering its 'forgetting' critical information in its note. It's just another way in which criminals are unreliable 'business partners,' particularly, to their victims.