NEFILIM Ransomware

NEFILIM Ransomware is one of those terribly annoying infections that wreck your system and then disappear. In other words, there might be nothing left to remove once NEFILIM Ransomware has entered your system, but the damage will be there. Since it is not possible to decrypt this application at the moment, you will have to look for other ways to restore your files. If you find yourself at a loss, do not hesitate to address a professional who would help you learn more about file recovery methods. At the same time, you should also find out more about ransomware distribution.

Why would you need to learn about ransomware distribution? Well, the point is that we often cannot mitigate the damage caused by ransomware infections. It’s not like an antivirus antispyware program, where you delete it and your computer goes back to normal. Even if you delete the ransomware infection, the file encryption doesn’t disappear. Therefore, it is a lot more effective to PREVENT ransomware programs from entering your system. For that, you need to know how ransomware programs get distributed across the web. There are several ways for these programs to reach you, but the pattern is usually very similar.

As far as NEFILIM Ransomware is concerned, our research suggests that this infection probably spreads through unsecured RDP connections. It means that users might receive some file through an RDP connection, and if they often exchange files with colleagues and friends through this medium, they might not think twice about opening that file. However, if the file comes from an unknown party, you definitely should look into it. In fact, it would be for the best if you could scan the received files with a security tool before opening them. It’s not just about ransomware. It should apply to all the files received from unknown sources.

However, if you run the malicious installer file, you will soon see that NEFILIM Ransomware runs the encryption almost immediately. Based on what we know, this infection doesn’t belong to any big family of ransomware programs, but it DOES share code similarities with Nemty Ransomware. That wouldn’t be too surprising, to be honest. It is common for ransomware developers to take the code or the backbone of some program and modify it to create their own new infection. It is also very likely that Nemty Ransomware and NEFILIM Ransomware were developed by the same people.

So, what exactly happens when NEFILIM Ransomware enters the target system? This program works like any other ransomware infection out there, really. It runs a full system scan looking for the files it can affect, and once it locates those files, it runs the encryption. After the encryption, all the affected files receive a new extension. For example, if you have a dog.jpeg file on your computer, once the encryption is complete, the filename will look like dog.jpeg.NEFILIM, and this new extension will be like a stamp that tells you your files were affected by the encryption.

Aside from that, NEFILIM Ransomware also displays a ransom note. That’s a common practice among similar infections. Instead of pinning the ransom note on your desktop, the infection drops the ransom note in the directories with encrypted files. The ransom note is in the NEFILIM-DECRYPT.txt files. Here’s an extract from it:

All of your files have been encrypted with military grade algorithms.
We ensure that the only way to retrieve your data is with our software.
We will make sure you retrieve your data swiftly and securely when our demands are met.
<…>
After you contact us we will provide you proof that your files have been extracted.

Thus, as you can see, NEFILIM Ransomware doesn’t even say how much you are supposed to pay for file decryption. It just asks you to contact them. Although no public decryption tool is available at the moment, you shouldn’t send your money to these criminals.

If you have a file backup, simply run a full system scan with a security tool of your choice and remove all the malicious files. Then delete the encrypted files and transfer the healthy copies of your files back into your computer. If that is not something you can afford, try addressing a professional who would tell you more about file recovery options.

How to Remove NEFILIM Ransomware

1. Delete recent files from Desktop.
2. Remove recent files from the Downloads folder.
3. Press Win+R and type %TEMP%. Click OK.
4. Remove recent files from the directory.
5. Scan your computer with SpyHunter.