DJVU Ransomware Nlah Variant Charges Victims Nearly $1000 to Decrypt Their Files

Nlah ransomware is a malicious software that belongs to the well-known DJVU family. The sole purpose of this encryption-based malware is to lock all the files on the victim’s computer. The cybercriminals behind Nlah will then coerce the victims nearly $1,000 ransom in Bitcoins for releasing their data.

How Does Nlah Ransomware Infect Computers

Usually, the payload of Nlah ransomware is launched via spam campaigns, downloaded pirated software on P2P networks, fake updaters, ‘cracked’ activation tools, or trojans. 

Spam campaigns are the most common method for malware distribution. The attackers use them to refer to a large scale operation, during which thousands of deceptive emails are sent to target users. The scam messages contain malicious files that are either attached to them or include download links of such. When the victim clicks on these links, the ransomware payload is activated.

How Does Nlah Ransomware Operate

Usually, Nlah ransomware drops a malicious executable file in the %LocalAppData% or %AppData% disguised as legitimate Windows OS files. After the installation process starts, the ransomware payload alters the Windows Registry, Task Manager, Boot sequence to gain control over the system and launches the encryption algorithm. 

 During the encryption process, the names of the affected files are appended with the ".nlah" extension. For instance, a file that is originally named "1.jpg" would be changed to "1.jpg.nlah" after the encryption.

Nlah's Ransom note

The ransom note states that the victim’s files have been encrypted with the strongest encryption and unique key, and they are no longer usable. The only way to restore is by purchasing the decryption tool from the malware authors. The price of this tool is $980, but if the victim contacts the attackers within 72 hours, a 50% discount is available. This is fairly unique as ransomware usually threatens to increase the price within the time limit. These threat actors seem to have opted for the carrot approach instead of the stick.

The contact e-mails are provided in the ransom note. Before paying the fee, users can test the decryption tool by sending one encrypted file to the criminals. The bad actors will send it back to the victim after decrypting it as proof that the files are still recoverable. If the victim does not receive a response in 6 hours, they are instructed to check their "Junk/Spam" email folder. 

How to Remove Nlah Ransomware

The problem here is that in many cases of ransomware infections, the decryption process is impossible without involving the malware authors. Data recovery might be possible only if the malware is still in its development phase or it has significant flaws. Also, quite often, despite paying, the victim does not receive the decryption key. Therefore, paying the ransom is not recommended.

Malware removal may appear to be quite overwhelming due to the severity of the infection. Since Nlah ransomware is considered one of the most destructive and stealthy pieces of malware, security researchers advise its victims to search for expert advice. Otherwise, the encrypted data may be permanently lost, and the infected systems may be damaged for good.