Ransomware Research

Nemucod-AES Ransomware

Nemucod-AES is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on June 1, 2017, this ransomware has been actively targeting systems worldwide.

Quick Facts

Ransomware Family
Nemucod-AES
First Seen
June 1, 2017

How Nemucod-AES Ransomware Works

Targeted Files

https://www.hybrid-analysis.com/sample/3124ddac6d47edef4839ee32df03ff346ab1e154b643748855aff75a320a12ae?environmentId=100 https://www.hybrid-analysis.com/sample/52ff1fa29675a6c55cab30d1dc0477c89b8f65e4e8b37ef56d2afc7c3058eac9?environmentId=100 param (php 5.6.30) -> php.exe 1FTaZDFWbBJHKsaU96ki8ozQj27XHdmoMg.php 1FTaZDFWbBJHKsaU96ki8ozQj27XHdmoMg 0.14745 MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAg2nbziQxZDzkLnFx/f9q1h2uzI+YQqhuQO9kMafj2VjFLxqOME4tLPAHVuenKJadZdQ5kncrDBP2SwUhQ1FxwU5SozxcRC3XrJV3iM2KScB8jQ/jkDA5l3KvEYshOO0vCXAtBgdh/2qsooONhnCl2JzcoHuMGPFypZ8oQ8pd0t8juJvyUrM5CSm0khimi7wdn+yP4QmxEtwl7uiWuWYiw93u+PrjZgn2Z3vXhEVOsVLwb4DjyKy3HED+8PQxauRUuFzKDE+x5BeutEQLCouTK/tljabICYR7aH0lMg9d0CSu6VPZ6Oqsbch0VvG8GtQBgfAPs97nFTDKG5f9Iof4tQIDAQAB Doesn't change filenames https://www.hybrid-analysis.com/sample/8d04ed4fdef1465686264662fb72c9e64ca60d6ea94c351d0a7c27aeb65d95bc?environmentId=100

File Encryption Patterns

Nemucod-AES modifies encrypted files using specific patterns to mark them as encrypted:

File extensions added after encryption:

..crypted

Ransom Note and Payment Demands

After encrypting files, Nemucod-AES displays ransom notes demanding payment for file recovery:

fileDECRYPT.txt

Ransom message:

notes/DECRYPT.txt

Note locations:

Desktop
fileDesktop.hta

Ransom message:

notes/Desktop.hta

Technical Indicators

Associated Executable Files

The following executable files are associated with Nemucod-AES ransomware:

  • 421841.js
  • myvtfile.exe
  • UPS-Delivery-005156577.doc.js
  • UPS-Receipt-4424638.doc.js
  • UPS-Parcel-ID-4563806.doc.js

Elastio Can Help You

Don't let Nemucod-AES ransomware take over your data

Elastio provides advanced ransomware protection and recovery solutions to keep your organization safe.

Learn MoreGet Started

About This Analysis

This Nemucod-AES ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery solutions, helping organizations defend against and recover from ransomware attacks like Nemucod-AES.

Last updated: July 30, 2025

Recent Ransomware

Explore other threats in our database

View all ransomware
Nemucod-AES Ransomware - Detectable by Elastio