Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


Remove Nuke Ransomware and Restore AES Encrypted Files

nuke-ransomware-sensorstechforum-ransomware-malwareNuke ransomware virus is here and it aims to nuke any chance it’s victims have of seeing their files again, by encrypting them with a strong AES-256 bit cipher. The ransomware demands from affected users to contact the criminals at [email protected] to get more instructions on how to get their files back. What Is interesting about Nuke is that this variant uses a .pdb file to encrypt data which is rarely seen in ransomware viruses. In case you have become a victim of the Nuke virus, we strongly urge you to back up the encrypted files and use the instructions below to attempt and decrypt them after removing Nuke from your computer.

Threat Summary

NameNuke Ransomware
TypeRansomware
Short DescriptionThe ransomware encrypts files with the AES-256 encryption algorithm.
SymptomsFiles are encrypted and become inaccessible. A ransom note with instructions for paying the ransom shows as a wallpaper.
Distribution MethodSpam Emails, Email Attachments, File Sharing Networks.
Detection Tool See If Your System Has Been Affected by Nuke Ransomware

Download

Malware Removal Tool

User ExperienceJoin our forum to Discuss Nuke Ransomware.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

How Does Nuke Ransomware Infect

Typically to ransomware infections, like the latest Locky, Nuke may spread via different spam campaigns of malicious files or URLs. Such campaigns are mostly conducted via phishing e-mail messages, but they may also spread spam on social media websites as well as other online locations.

To perform a successful infection. However, an exploit kit may be used by Nuke ransomware which essentially takes advantage of several different exploits in Windows to cause a successful infection. Another method of infection may be If an obfuscated.JS (JavaScript) is being used to slither the malware without any trace of files left on the compromised computer.

What Does Nuke Do After Infection

After it contaminates a targeted computer, the virus may drop it’s malicious payload, named Nuke.pdb in the following Windows directory:

→ D:\Software\Nuke\Nuke\bin\Debug\CryptoObfuscator_Output\Nuke.pdb

The file format of the file is very interesting (.PDB) and according to Fileinfo (http://fileinfo.com/extension/pdb) this type of file is associated with the following programs:

  • Quicken.
  • Microsoft Visual Studio.
  • Pegasus.
  • Palm Pilot.

It is not yet clear whether this file is the Program Database file format. It may simply carry the .pdb file extension, but it most likely is and could be used to probably exploit one of the programs above and encrypt user files.

To encrypt files of a compromised computer, the virus uses several different methods and strategies. Some of those methods are primarily oriented with scanning and comparing file extensions from a pre-configured list of such to encrypt. Nuke ransomware may target file extensions of widely used file types, such as:

  • Videos.
  • Audio files.
  • Adobe Reader files.
  • Microsoft Office documents.
  • Adobe Photoshop files.
  • Photos.

After encryption, the Nuke ransomware virus adds the following ransom note as a wallpaper:

nuke-ransomware-sensorstechforum

In addition to this another file is also added with detailed instructions on paying the ransom as well:

nuke-ransowmare-ransom-note-sensorstechforum

Nuke Ransomware – Conclusion, Removal, and File Restoration

As a bottom line, Nuke Ransomware is a malware threat resembling most Shade XTBL variants. However, do not be fooled by it and do not take it lightly. We will keep researching and post a decrypter if it is available for this virus as soon as it is.

In the meantime, it is higly advisable to follow the instructions below and remove Nuke ransomware and also attempt to restore your files using the alternatives in step “2. Restore files encrypted by Nuke” below. Make sure to backup the files before attempting any type of file decryption.

Manually delete Nuke Ransomware from your computer

Note! Substantial notification about the Nuke Ransomware threat: Manual removal of Nuke Ransomware requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove Nuke Ransomware files and objects
2.Find malicious files created by Nuke Ransomware on your PC

Automatically remove Nuke Ransomware by downloading an advanced anti-malware program

1. Remove Nuke Ransomware with SpyHunter Anti-Malware Tool and back up your data
2. Restore files encrypted by Nuke Ransomware
Optional: Using Alternative Anti-Malware Tools

Vencislav Krustev

A network administrator and malware researcher at SensorsTechForum with passion for discovery of new shifts and innovations in cyber security. Strong believer in basic education of every user towards online safety.

More Posts - Website

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.