Nemucod-AES Ransomware

The Nemucod-AES Ransomware is a new variant of Nemucod, a family of Trojans dedicated to loading other threats previously that, later, transitioned into file-encrypting attacks. This Trojan uses a secure encryption algorithm to lock your files and, then, loads an image showing its demands for Bitcoins. Having external backups can keep threats of this classification from causing any permanent harm, and most anti-malware products should quarantine or delete the Nemucod-AES Ransomware as soon as they detect it.

Con Artists Busy Baby-Proofing Their Attacks

Threat actors trying to extort money have it in their best interest to lie about the dangers of not paying them loudly and frequently when it comes to recovering digital media especially. A routine facet of most file-encrypting Trojan campaigns is that they tend to show inaccurate information about the strength of their enciphering features, which are often, but not always, breakable with a little effort. Unfortunately, there now is one less in the membership of easily cracked threats, as the Nemucod Ransomware campaign is updating to the Nemucod-AES Ransomware.

Although the first versions of the Nemucod Ransomware are using a relatively simple, XOR-based attack to lock the files of their victims, the Nemucod-AES Ransomware is upgraded to use the AES-128 and RSA-2048. This means of enciphering documents, pictures, and other media can prevent you from opening them permanently, or until the remote attacker provides the decryption program. Unlike old variants of the same threat, the Nemucod-AES Ransomware is unbreakable by third-party decryptors effectively, without further bugs or mistakes from its threat actors.

Malware researchers also find the Nemucod-AES Ransomware using a minor variant of its older ransom note, which it loads in an image-based format and places on your desktop. The message asks for a small fraction of the Bitcoin currency to provide the download link for its decryptor, converting to just under 300 USD. Also of note is that the Nemucod-AES Ransomware retains its old, modular structure, instead of consisting of one executable, and will download its other components as needed.

The Mail that's not Worth Taking

The Nemucod-AES Ransomware attacks are targeting US victims in particular, with the infection method of choice being e-mail spam campaigns. Malware experts are finding forged messages carrying this threat's installer pretending to be UPS delivery notices, which could be suitable for compromising recreational users or business networks equally. Readers shouldn't forget that e-mail attachments are an in-vogue way for threat actors to circulate many kinds of threatening software, including file-encrypting Trojans.

The Nemucod-AES Ransomware benefits from layered defenses against old decryption methods, and having a backup that the Nemucod-AES Ransomware can neither encode nor delete is the easiest means of guaranteeing the safety of your media. Compromised PCs may show few or no symptoms until the data-locking attack concludes, although, afterward, the user may note such changes as new extensions on their files or a new desktop wallpaper. Anti-malware programs previously viable against the Nemucod family also can delete the Nemucod-AES Ransomware safely, and, hopefully, before it locks your content.

Just like money never truly stops flowing, money-making misdeeds never stop advancing and evolving. It's perilous to assume that the limitations of old Trojans will apply to the next release of the same program, as the Nemucod-AES Ransomware so well shows.

Technical Details