Terminating NxRansomware (Crypto-Malware/Ransomware)

What is NxRansomware? And how does it execute its attack?

NxRansomware or Nx (Next) Ransomware is an open-source ransomware project developed by G.B. Moralez. Way back in 2016, it was freely accessible in GitHub for merely research purposes. The following context outlines the real purpose of NxRansomware:
“Disclaimer
This code is created and maintained only for a research proposal. Please do not use for other proposes.
Please, do not run the code with a release profile. It can be seriously dangerous. Really!
Objectives
This project has 2 main objectives:
Malware Side
– Prove that’s possible to write a viable “product” using the. Net Framework
– Prove that is hard and painfull to anti-virus to detect this kind of virus
– Understand the execution environments
– Understand the technical challenges to create a real and operational ransomware
– Provide code and samples to AV companies and Security researchers
C&C (Command and Control) Side
– Build a state of art C&C system, using the latest technologies to prevent the backend hijack and invasion
– Create a viable, safe and secure communication channel between the malware and C&C infrastructure without using SSL certificates
– Build a reversion proof C&C database system, using an in-memory storage and advanced cryptographic algorithms”
The developer even prohibited users from exploiting this file-encrypting virus for malicious activities. But this warning was clearly ignored – it’s like prohibiting Eve from eating the forbidden fruit – totally useless. Security experts were able to spot a malicious version of this file-encrypting virus this month spreading as a fake update named GoogleUpdate1.exe. This ransomware is dangerous according to security researchers and can cause tremendous damage to the affected computer. It is created using the. Net Framework and C&C System and is also called as the next generation of ransomware.
As soon as the malicious executable file is executed, Nx ransomware will be installed in the computer. After its successful infiltration, it will scan the computer looking for files to encrypt. According to id-ransomware.blogspot.bg, it encrypts files with the following extensions:
.AVI, .C, .CLASS, .CONFIG, .CPP, .CS, .CSC, .DBX, .DOC, .DOCX, .EML, .GIF, .GZ, .H, .JAVA, .JPG, .JS, .JSON, .JSP, .MBX, .MP3, .MP4, .MPEG, .MSG, .NEF, .PDF, .PHP, .PNG, .PPT, .PPTX, .PST, .PY, .R, .RAR, .TAR, .TXT, .VB, .VBS, .WAB, .XAML, .XLS, .XLSX, .ZIP
Nx ransomware uses both the AES and RSA encryption algorithms in encrypting the files – the AES cipher may be used to scramble important files while the RSA cipher may be used to further insert private and public keys within the files themselves making it its recovery extremely difficult mainly because the files may be assigned with different keys. After the encryption, Nx ransomware delivers its ransom note in a program window labeled “I’ll Make You Cry 😀 :D” and contains the following message:
“What has happened To your Computer?
Your computer has been encrypted
It’s better to pay ransom
Or we are going to make you feel sorry
Then nobody will help you out”
If you are one of the unlucky users who got infected with this ransomware threat, there is no need for you to panic as the researcher of this next generation ransomware has shared the open source code with the security software developers so recovering the encrypted files won’t be a problem.
How does NxRansomware proliferate?
As mentioned before, NxRansomware currently spreads as a fake Google Update file. This malicious file could spread in spam emails since cybercriminals tend to favor this distribution method in proliferating ransomware infections. It could also spread in peer-to-peer file sharing networks so you have to be careful when downloading files from suspicious sites. In addition, you also have to be cautious in opening emails especially the suspicious-looking ones as cybercriminals often disguise their emails to trick users into opening the email and downloading the corrupted attachment.
Make sure you terminate NxRansomware from your computer before it causes further damage by following the instructions below.
Step 1: Close the program window of Nx ransomware and tap the Win + E keys to open File Explorer.
Step 2: Navigate to the following locations and look for the malicious files created by Nx ransomware one of which is the GoogleUpdate1.exe, and delete them all.

%TEMP%
%WINDIR%
%APPDATA%
%DESKTOP%
%USERPROFILE%\Downloads
%HOMEDRIVE%\user
%USERPROFILE%\Desktop

Step 3: Close the File Explorer and tap Ctrl + Shift + Esc keys to open the Task Manager.

Step 4: After opening the Task Manager, look for Nx ransomware’s malicious process, right click on it and select End Process or End Task.

Step 5: Close the Task Manager.
Before you proceed to the next steps below, make sure that you are tech savvy enough to the point where you know exactly how to use and navigate your computer’s Registry. Keep in mind that any changes you make will highly impact your computer. To save you the trouble and time, you can just use PC Cleaner Pro, this system tool is proven to be safe and excellent enough that hackers won’t be able to hack into it. But if you can manage Windows Registry well, then, by all means, go on to the next steps.
Step 6: Tap Win + R to open Run and then type in regedit in the field and tap enter to pull up Windows Registry.

Step 7: Navigate to the paths listed below:

HKEY_CURRENT_USER\Control Panel\Desktop\
HKEY_USERS\.DEFAULT\Control Panel\Desktop\
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

Step 8: Look for any suspicious values created by Nx ransomware and delete them.
Step 9: Close the Registry Editor and open Control Panel by pressing the Windows key + R, then type in appwiz.cpl and then click OK or press Enter.
Step 10: Look for Nx ransomware or any suspicious program and then Uninstall it/them.

Step 11: Empty your Recycle Bin.
Ensure the removal of Nx ransomware from your computer as well as the malicious files it created with the help of the advanced removal instructions below.
Perform a full system scan using SpyRemover Pro. To do so, follow these steps:

Turn on your computer. If it’s already on, you have to reboot
After that, the BIOS screen will be isplayed, but if Windows pops up instead, reboot your computer and try again. Once you’re on the BIOS screen, repeat pressing F8, by doing so the Advanced Option shows up.

To navigate the Advanced Option use the arrow keys and select Safe Mode with Networking then hit
Windows will now load the SafeMode with Networking.
Press and hold both R key and Windows key.

If done correctly, the Windows Run Box will show up.
Type in explorer http://www.fixmypcfree.com/install/spyremoverpro

A single space must be in between explorer and http. Click OK.

A dialog box will be displayed by Internet Explorer. Click Run to begin downloading the program. The installation will start automatically once a download is done.