Nodera Ransomware written is Node.js framework (framework used to create web applications in JavaScript). Writing malware in Node.js is an usual choice. Nodera affect Windows operating systems and it appeared to be still in development phase as ransom note refers to a 2048-bit RSA public key in the ransom note, where as the public key embedded in the script is 4096 bits. Secondly it indicates the date "March 1, 2018" as the time of destruction of the private key and thirdly there is no communication channel mentioned in the ransom note to receive the private key. Once executed, the ransomware encrypts the files and adds the extension ".encrypted" .
Nodera Ransomware Sample Signatures
Family: Ransom:VBS/Filecoder.G!MTB
MD5: e8cfee97467d4006257afdaabf945565
SHA256: 7265c1fb74eb9ea3cd98358475620ce54b9033421ba042957135bdefd078b366
Nodera Ransomware Sample Download
