Nemucod Ransomware

The Nemucod Ransomware is a revision of the Nemucod, a Trojan family dedicated solely to installing other threats previously. This new variant conducts traditional file-encrypting attacks and ransom attempts, but not to the exclusion of its Trojan downloader function. The multiple angles of attack by the Nemucod Ransomware force malware researchers to recommend scanning your entire system with anti-malware tools for both removing the Nemucod Ransomware and its payloads while other methods can restore your encrypted data freely.

The Trojan that Expanded Its Horizons

Most threats dedicate themselves to a single purpose, with any further specialization accomplished through the addition of independent plugins or other software. It's rare for threatening software to display two completely unrelated specialties and even rarer for such a feature's inclusion after a long history of its omission. Despite all the above, the Nemucod Ransomware is breaking new ground as a fully-functional Trojan downloader that also includes the standard payloads of a file encryptor.

The Nemucod Ransomware still uses the previous infection methods preferred by its family, which consist of disguised e-mail spam, with accompanying attachments providing the threat with its installation. The Trojan also continues using JavaScript but has been patched to take extra steps before initiating its traditional payload.

First, the Nemucod Ransomware downloads a second file for the actual encryption agent. It then generates a text file that includes the ransom message (claiming that an RSA-1024 algorithm has encrypted your data, and demanding Bitcoin payments for a decryptor), although it does not display the message immediately. After scanning all available hard drives for files of various types, such as spreadsheets or documents, the Nemucod Ransomware submits each appropriate file to the encryptor, which uses a symmetric XOR algorithm. Victims should note that this algorithm is not the same as the one claimed in the ransom message, and is potentially crackable.

Only after these procedures does the Nemucod Ransomware finally display its ransom note, which asks for Bitcoin payments in exchange for a decryption routine that gives your files back to you. The affected files are identifiable by eye due to an extra '.crypted' extension. Malware researchers also emphasize that the Nemucod Ransomware still drops additional threats onto your PC afterward, completely separate from its ransom-based attacks.

Dousing the Revenue of Hopeful Trojan Developers

On multiple fronts, the Nemucod Ransomware shows some of the clearest trends in threat development in 2016. Like many of the simpler, less professionally-coded threats, the Nemucod Ransomware does not use the nigh-impossible to break encryption methods named in its ransom instructions. The Nemucod Ransomware also makes no attempt to delete even local backup data, which is a mistake that a dedicated file encryptor family would be unlikely to make. Consequentially, victims can use multiple means of restoring backups without buying the Nemucod Ransomware's decryption service. The straightforward decryption solution also means that various PC security entities may be able to develop free decryptor apps in short notice.

At the same time, the Nemucod Ransomware still functions effectively as a threat that denies you access to your files, and, perhaps most dangerously, will install other threats with different purposes. You should assume that all the Nemucod and other Trojan downloader-based infections are multi-threat scenarios, potentially including threats such as rootkits or spyware. Use general system scans as provided by your local anti-malware products for identifying these programs and deleting them, along with deleting the Nemucod Ransomware.

The evolving nature of its payloads aside, the Nemucod Ransomware does still using traditional infection methods that you may halt by something as simple as double-checking the authenticity of an e-mail message. Even scanning a suspicious attachment can be the easiest way to keep your files from being the latest to wear a '.crypted' extension.

Technical Details