Nemucod ransomware information

Nemucod ransomware information

Nemucod ransomware information:

This is a quick post on the recent Nemucod ransomware. Nemucod is (normally) a downloader which uses JavaScript  JScript (thanks Katja) to enter an unsuspecting user’s machine and download additional malware (depends on campaign usually).

There’s a blog post by Fortinet which explains Nemucod ransomware, so I’m not going to repeat much here: Nemucod Adds Ransomware Routine

It came to our attention that a new, rather peculiar version of Nemucod has been recently landing on users. Nemucod is a well-known JavaScript malware family that arrives via spam email and downloads additional malware to PCs.

This particular campaign is using the lure of a court appeal to spread:

The mail reads:

Notice to Appear,
You have to appear in the Court on the April 22.Please, prepare all the documents relating to the case and bring them to Court on the specified date.Note: If you do not come, the case will be heard in your absence.
The Court Notice is attached to this email.
Yours faithfully,Brian Snider,District Clerk.

It seems Nemucod ransomware got another update, as it now uses 7-zip to actually encrypt the files.

Another change is the slight drop in price. Whereas before it was 0.60358 bitcoins ($267.14 or €236.43), it’s now 0.49731 bitcoins ($220.11 or €194.80).

New message reads:

Nemucod ransomware message
Nemucod encrypting a whole plethora of filetypes, appending the .crypted extension

If you have opened a .JS file (JScript file) from an unknown sender, open Task Manager immediately and stop all the following processes (at least in this version of Nemucod):

a0.exe (actually 7-zip disguised)

The faster you do this, the less files will be encrypted. Run a scan with your antivirus program and a scan with another antivirus program to verify the malware has been removed.

Note: It’s always useful to keep a copy of the ransomware note handy, as it’s easier to identify the ransomware and if it can be decrypted.

I’m only briefly reporting on this for those in need, but currently, the known decryptors are suited for this version. However, Fabian from Emsisoft is already working hard to make a decryptor available, so please have patience!

If you have an older version of Nemucod, you can try one of either decryptors:
Emsisoft Decrypter for Nemucod 
nemucod_decrypter (you will need to install Python for this)

You can also try restoring files with Shadow Explorer. (alternate link)
For more information, please visit the following Bleeping Computer topic
.crypted Ransomware (Nemucod) – Decrypt.txt Support and Help Topic

Contact CCN for a complete managed security solution.

Same as with all malware: don’t open attachments from unknown senders!


About CCN

Chicago Computer Network (CCN) Inc. is a leading provider of Information Technology (IT) and consulting services for Chicago-based businesses. At CCN, we enthusiastically provide outstanding IT support and are committed to saving you time and money, while delivering long-term technology solutions to meet the current and evolving needs of your business.

Clients Worlwide

CCN has helped clients around the globe manage their IT services.


Business Hours: 8a-5p M-F
Managed Services: 24/7/365 Support

© Chicago Computer Network | All Rights Reserved