Rewterz Threat Alert – Nodera Ransomware

Severity

High

Analysis Summary

Nodera is a ransomware family that uses the Node.js framework and was discovered by researchers. The infection chain starts with a VBS script embedded with multiple JavaScript files. Upon execution, a directory is created and both the main node.exe program and several required NodeJS files are downloaded into the directory. Additionally, a malicious JavaScript payload that performs the encryption process is saved in this directory. After checking that it has admin privileges and setting applicable variables, the malicious JavaScript file enumerates the drives to create a list of targets. Processes associated with common user file types are stopped and volume shadow copies are deleted. Finally, all user-specific files on the C: drive and all files on other drives are encrypted and are appended with a “.encrypted” extension. The ransom note containing instructions on paying the Bitcoin ransom are provided along with a batch script to be used for decryption after obtaining the private key.

Impact

File encryption

Indicators of Compromise

MD5

• 976b17845289d9f8a5ee1c8a9e9c4173
• e8cfee97467d4006257afdaabf945565

SHA-256

• 7265c1fb74eb9ea3cd98358475620ce54b9033421ba042957135bdefd078b366
• 53a95c9126be8262afb0821da4d7137e6c8a4d9b363f91298249ca134d394bf4

SHA1

• c458e4c32e3ebb1fca331ef235fe3f96e505e066
• 7879bbaf9bd6de58a7b318d013cd479d4a24ffae

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the links/attachments sent by unknown senders.