Nemucod ransomware is the file-encrypting stage of the Nemucod JavaScript downloader, active in 2016. Encrypted files get a .crypted suffix, and a note named DECRYPT.txt is placed on the desktop. It registers .crypted as a file type so that opening a locked file shows the note. Emsisoft and Trend Micro both publish free decryptors. Earlier, the downloader pushed TeslaCrypt. Later versions dropped that payload for their own routine, which XORs only the first 2,048 bytes of each file with a 255-byte key. Spam attachments deliver it. No theft of data or leak site is tied to it. A later AES build, NemucodAES, has its own decryptor.
Sources: In-house research
Decryptor: A free decryptor is available.
From the ransom note DECRYPT.txt:
ATTENTION! All your documents, photos, databases and other important personal files were encrypted using strong RSA-1024 algorithm with a unique key. To restore your files you have to pay 0.29754 BTC (bitcoins). Please follow this manual: 1. Create Bitcoin wallet here: hxxps[://]blockchain.info/wallet/new 2. Buy 0.29754 BTC with cash, using search here: hxxps[://]localbitcoins[.]com/buy_bitcoins […]
Sources: Emsisoft
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161