Nosu ransomware: what it is and how to remove it

From our report of Jan 2020 · not reviewed since

More from our earlier report on Nosu ransomware

• _readme.txt – the file that delivers a money-demanding text which also contains instructions, ransom amount, contact information
• You need to remove Nosu ransomware from the machine as soon as possible, so the threat is terminated and cannot damage the computer further.
• Use professional anti-malware tools for this job and make sure to double-check before recovering data
• There is a huge possibility that malware affected crucial parts of the machine, including system functions, files or even settings.
• Get a system optimizer like or a cleaner utility and run on the computer to locate any files that need to get fixed or repaired

From our report of Jan 2020 · not reviewed since

Nosu ransomware is the cryptovirus that can encrypt valuable files and transfer other data to remote servers for later use

Nosu ransomware – a malware that focuses on encryption, so ransom can get demanded directly from victims.

This is a member of the DJVU ransomware family that is known for delivering such viruses for a few years now. The infection triggers additional services and comes in a few phases, so malicious operations continue even after the main event - encryption. This threat can create Windows registry entries, disable functions, install files or programs, and even steal data from the machine.

It is common for such threats to disable security programs or system features that can help with virus removal or data recovery processes. Malicious actors who create this threat try to make sure that victims have fewer opportunities to recover from the attack and chooses to pay up, so their data gets restored by the criminals.

Victims of the previous versions had more options for data recovery because researchers offered a few services designed for decryption and file recovery. Unfortunately, STOPDecrypter is no longer supported since Nosu ransomware virus developers changed their encryption coding and the method of generating victims' IDs.

Many versions that came out in Summer 2019 go decrypted using common offline keys. Since August of last year, victims cannot get their files back because online keys get employed more often.

There might be a solution for files encrypted by this Nosu files virus, but you need to determine if the ID that is presented in the ransom note file _readme.txt ends in t1 or not.

This is important because the recently designed Emsisoft decryption tool offers the service for people whose devices got encrypted by the offline versions - containing the t1 at the end of the identification key. In other cases, the best option is to remove the threat using AV tools and then to recover files using thrid-party companies or data backups from external devices.

Nosu files virus is the threat that aims at users all over the world and targets commonly used files like photos, videos, documents, databases, and archives. The infiltration of the threat starts unnoticed, and quickly after that, encryption is started. Files in needed formats and types get encrypted in minutes, and ransom demand shows up on the screen for the victim.

The money-asking note is not much changed from the first version of the family. Nosu ransomware itself is almost identical to all the threats released before this one because the ransom note file is still named _readme.tx and still delivers the same informational message.

The only thing that malicious actors keep on changing is the contact emails. Yet still, this particular threat shares the same contact emails with a few other versions from December.

Nosu ransomware also demands the same amount of money and offers a discount for people who manage to contact criminals in the first 72 hours. That is not recommended to do, however. Noone in the field of cybersecurity can state that contacting or paying these criminals is a positive action.

You may end up contacting criminals and getting more malware in return instead of Nosu ransomware removal or decryption software. There is no need to even consider paying criminals, especially when it is known that little to none of paying victims manage to get their files back.

The best option when you want to remove Nosu ransomware is anti-malware tools that can possibly detect the threat and get rid of it. However, you should go through the system and save encrypted files, ransomware-related data on the external device.

It may be possible that law enforcement or researchers will obtain decryption keys and restore those files in the future. Remember to clean the machine and repair damage with before any file recovery, so you can avoid getting files encrypted again.

Nosu ransom-demanding threat delivers this text after the first encryption phase of the attack:

Even though this is the newer version of the DJVU ransomware, there are many similarities. You need to know the particular file extension and identification key placed in the ransom note to determine that this is Nosu ransomware and to specify the encryption method that may be offline or online. This fact determines what you need to do next and what options you have.

From our report of Jan 2020 · not reviewed since

Decryption and file recovery options after Nosu ransomware attack

Nosu ransomware belongs to a family that is now a well-known - a positive thing for victims because anti-malware tools include each new version in the database pretty quickly.

The virus itself can be deleted from the system with such software, but encrypted data remains encrypted, and some system files still may be damaged.

For possible decryption options, there are a few factors that need to be determined with each Nosu ransomware victim:

When the creators of the threat use offline IDs/ keys the threat is not connecting to command and control servers while encoding files, so the encryption uses a built-in ID. This process means that many IDs end in t1 and can be easily identified.

Also, Nosu ransomware victims that have been affected by the same version can get their file decrypted with the help of the released offline ID. The same key works for many people that suffered the encryption using that one key and RSA encryption method.

When online IDs get used in the process, ransomware connects to C&Cservers and generates random keys for each of the victims. Each computer has its own key, and you cannot use the same ID for many devices.

Each person needs to get its own key for the decryption that is the only one generated for them. However, that can be obtained from criminals directly or after the breach, incarceration when the database becomes public.

The older versions from the same creators had more options since decryption tools got developed for them. Nearly every victim of these versions released until August 2019, got their files recovered by researchers.

Unfortunately, Nosu ransomware is the newer version, so it uses the secure RSA encryption algorithm and is based on online keys that leave not many solutions for victims. It is even possible that DJVU will no longer be decrypted until the end of the service, so focus on malware elimination and file recovery ignoring the barely possible decryption talks.

• offline vs. online key usage;
• old vs. new variants.

From our report of Jan 2020 · not reviewed since

Hidden codes get triggered by simple users' action

Cracked applications, p2p services, illegal pirating sites, and torrent pages can contain many more malware-related features than you may think in the first place.

Freeware installations, software cracks, or license numbers, game cheats distributed from insecure sources can hide malicious ransomware code and lead to the infection directly.

Dubious links in spam email notifications or websites you get redirected to from additional scam campaigns all lead to the infiltration of malware. You cannot notice such payload droppers or even trigger the drop yourself when you click or allow any content. The code of malware can get disguised as a tool or update, so avoid any pirated software sites and choose reliable sources when getting any applications, files.

keep an eye for these red flags in suspicious emails:

• typos;
• grammar mistakes;
• misspelled company names;
• shortened links;
• financial emails from unfamiliar companies.

From our report of Jan 2020 · not reviewed since

Tips for the proper Nosu files virus elimination

The best recommendation for any victim of the Nosu ransomware virus is to get rid of the malware as soon as possible.

You need to do that, so system files and functions can still properly run. When cryptovirus affects security tools and functions like system restore there is not much left to do.

However, when you remove Nosu ransomware using anti-malware tools or security software like , , you can ensure that malicious programs get terminated. Then, the only thing left to do is check system features, settings and virus damage results and recover those encrypted files.

Remember to run a cleaner or system tool to tackle the virus damage after the Nosu ransomware removal, so you cannot risk getting your data double-encrypted. Then, rely on your backups or third-party software and replace encoded files with safe ones.

[GI=method-1]Get rid of the threat by rebooting the device in Safe Mode with Networking

[GI=method-2]Makes sure that Nosu ransomware is no longer running with System Restore feature

Windows Previous Versions can be the alternate variant for the data backups

When System Restore is enabled for Nosu ransomware removal, you can recover encrypted files using Windows Previous Versions feature

ShadowExplorer is the method possibly helpful for encoded or deleted data

You can get your files back after the Nosu ransomware attack when Shadow Volume Copies are left untouched

Particular Nosu ransomware decryption tool is not availiable

You can try to use this DJVU decryptor that works for offline versions and older variants