Nuke ransomware virus is here and it aims to nuke any chance it’s victims have of seeing their files again, by encrypting them with a strong AES-256 bit cipher. The ransomware demands from affected users to contact the criminals at [email protected] to get more instructions on how to get their files back. What Is interesting about Nuke is that this variant uses a .pdb file to encrypt data which is rarely seen in ransomware viruses. In case you have become a victim of the Nuke virus, we strongly urge you to back up the encrypted files and use the instructions below to attempt and decrypt them after removing Nuke from your computer.
|Short Description||The ransomware encrypts files with the AES-256 encryption algorithm.|
|Symptoms||Files are encrypted and become inaccessible. A ransom note with instructions for paying the ransom shows as a wallpaper.|
|Distribution Method||Spam Emails, Email Attachments, File Sharing Networks.|
|Detection Tool|| See If Your System Has Been Affected by Nuke Ransomware |
Malware Removal Tool
|User Experience||Join our forum to Discuss Nuke Ransomware.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
How Does Nuke Ransomware Infect
Typically to ransomware infections, like the latest Locky, Nuke may spread via different spam campaigns of malicious files or URLs. Such campaigns are mostly conducted via phishing e-mail messages, but they may also spread spam on social media websites as well as other online locations.
What Does Nuke Do After Infection
After it contaminates a targeted computer, the virus may drop it’s malicious payload, named Nuke.pdb in the following Windows directory:
The file format of the file is very interesting (.PDB) and according to Fileinfo (http://fileinfo.com/extension/pdb) this type of file is associated with the following programs:
- Microsoft Visual Studio.
- Palm Pilot.
It is not yet clear whether this file is the Program Database file format. It may simply carry the .pdb file extension, but it most likely is and could be used to probably exploit one of the programs above and encrypt user files.
To encrypt files of a compromised computer, the virus uses several different methods and strategies. Some of those methods are primarily oriented with scanning and comparing file extensions from a pre-configured list of such to encrypt. Nuke ransomware may target file extensions of widely used file types, such as:
- Audio files.
- Adobe Reader files.
- Microsoft Office documents.
- Adobe Photoshop files.
After encryption, the Nuke ransomware virus adds the following ransom note as a wallpaper:
In addition to this another file is also added with detailed instructions on paying the ransom as well:
Nuke Ransomware – Conclusion, Removal, and File Restoration
As a bottom line, Nuke Ransomware is a malware threat resembling most Shade XTBL variants. However, do not be fooled by it and do not take it lightly. We will keep researching and post a decrypter if it is available for this virus as soon as it is.
In the meantime, it is higly advisable to follow the instructions below and remove Nuke ransomware and also attempt to restore your files using the alternatives in step “2. Restore files encrypted by Nuke” below. Make sure to backup the files before attempting any type of file decryption.