A sample of the Nemty ransomware was found to contain an artifact related to the GandCrab ransomware. It’s being distributed by the group who distributes the Sodinokibi malware and has similarities to the GandCrab operation. Despite the similarities, this does not definitively tie the operations and malware together. They further speculate that Nemty is in its early stages, but is being actively developed and may be part of a new Ransomware-as-a-Service operation. The attackers are currently asking for $1000 in bitcoins as a ransom and at this time, there is no practical way to decrypt files encrypted by Nemty without the Private Key pair of the Public Key embedded by Nemty. Payment is made through a page located on the Tor network.
Malware Hash (MD5/SHA1/SH256)