Emsisoft Decrypter for NemucodAES

Emsisoft Decrypter for NemucodAES is a tool designed to help you recover files hijacked by  NemucodAES and that are locked into an encrypted database on your %TEMP% folder.

As indicated by its name, NemucodAES is the newest member of the Nemucod family, a ransomware that is known to evolve consistently ever since its release. Unfortunately, not only did it comes with a new ransom note, but it also introduces a new encryption mechanism that makes it more challenging to get rid off.

While the spreading is still conducted via unsolicited emails, take note that the encryption component consists of a PHP script and interpreter that cycles through all your local and external drives. Unlike previous Nemucod malware, the new one comes with an AES-128 ECB and RSA encryption.

At the same time, since it does not modify extensions, users are going to be oblivious about the infection, except for the ransom note. Moreover, all locked files are moved into a database it creates in the local user temporary directory.

The idea behind the application is to access the database where all documents, databases or media files are encoded, namely DECRYPT.hta. The app should be able to detect the appropriate DB file as soon as you launch it; in case it does not, it is recommended that you contact the developer.

Once the app is launched, you should be able to view the app's GUI along with the progress and status of the decryption for each file. Depending on the number of files included in that database, you should be patient as the process can take up to several hours.

On a side note, despite the fact that they are part of the same ransomware family, Emsisoft Decrypter for Nemucod cannot be used to decode files infected with  NemucodAES due to the different encryption pattern.

In the eventuality that you have been infected with the newest Nemucod variant, then perhaps you can consider using Emsisoft Decrypter for NemucodAES to recover your data.