SYMBOLCOMMON_NAMEaka. SYNONYMS
win.nemty (Back to overview)

Nemty

VTCollection    

Nemty is a ransomware that was discovered in September 2019. Fortinet states that they found it being distributed through similar ways as Sodinokibi and also noted artfifacts they had seen before in Gandcrab.

References
2022-08-08 ⋅ Medium CSIS Techblog ⋅ Benoît Ancel
An inside view of domain anonymization as-a-service — the BraZZZerSFF infrastructure
Riltok magecart Anubis Azorult BetaBot Buer CoalaBot CryptBot DiamondFox DreamBot GCleaner ISFB Loki Password Stealer (PWS) MedusaLocker MeguminTrojan Nemty PsiX RedLine Stealer SmokeLoader STOP TinyNuke Vidar Zloader
2022-04-21 ⋅ Sentinel LABS ⋅ Antonis Terefos
Nokoyawa Ransomware | New Karma/Nemty Variant Wears Thin Disguise
Hive Karma Nemty Nokoyawa Ransomware
2022-03-16 ⋅ Symantec ⋅ Symantec Threat Hunter Team
The Ransomware Threat Landscape: What to Expect in 2022
AvosLocker BlackCat BlackMatter Conti DarkSide DoppelPaymer Emotet Hive Karma Mespinoza Nemty Squirrelwaffle VegaLocker WastedLocker Yanluowang Zeppelin
2021-10-18 ⋅ SentinelOne ⋅ Antonis Terefos
Karma Ransomware | An Emerging Threat With A Hint of Nemty Pedigree
Karma Nemty
2021-05-25 ⋅ Kaspersky ⋅ Fedor Sinitsyn, Yanis Zinchenko
Evolution of JSWorm ransomware
Nefilim Nemty
2021-05-10 ⋅ DarkTracer ⋅ DarkTracer
Intelligence Report on Ransomware Gangs on the DarkWeb: List of victim organizations attacked by ransomware gangs released on the DarkWeb
RansomEXX Avaddon Babuk Clop Conti Cuba DarkSide DoppelPaymer Egregor Hades LockBit Mailto Maze MedusaLocker Mespinoza Mount Locker Nefilim Nemty Pay2Key PwndLocker RagnarLocker Ragnarok RansomEXX REvil Sekhmet SunCrypt ThunderX
2021-05-06 ⋅ Cyborg Security ⋅ Brandon Denker
Ransomware: Hunting for Inhibiting System Backup or Recovery
Avaddon Conti DarkSide LockBit Mailto Maze Mespinoza Nemty PwndLocker RagnarLocker RansomEXX REvil Ryuk Snatch ThunderX
2021-04-12 ⋅ PTSecurity ⋅ PTSecurity
PaaS, or how hackers evade antivirus software
Amadey Bunitu Cerber Dridex ISFB KPOT Stealer Mailto Nemty Phobos Pony Predator The Thief QakBot Raccoon RTM SmokeLoader Zloader
2021-02-23 ⋅ CrowdStrike ⋅ CrowdStrike
2021 Global Threat Report
RansomEXX Amadey Anchor Avaddon BazarBackdoor Clop Cobalt Strike Conti Cutwail DanaBot DarkSide DoppelPaymer Dridex Egregor Emotet Hakbit IcedID JSOutProx KerrDown LockBit Mailto Maze MedusaLocker Mespinoza Mount Locker NedDnLoader Nemty Pay2Key PlugX Pushdo PwndLocker PyXie QakBot Quasar RAT RagnarLocker Ragnarok RansomEXX REvil Ryuk Sekhmet ShadowPad SmokeLoader Snake SUNBURST SunCrypt TEARDROP TrickBot WastedLocker Winnti Zloader Evilnum OUTLAW SPIDER RIDDLE SPIDER SOLAR SPIDER VIKING SPIDER
2021-02-02 ⋅ ⋅ CRONUP ⋅ Germán Fernández
De ataque con Malware a incidente de Ransomware
Avaddon BazarBackdoor Buer Clop Cobalt Strike Conti DanaBot Dharma Dridex Egregor Emotet Empire Downloader FriedEx GootKit IcedID MegaCortex Nemty Phorpiex PwndLocker PyXie QakBot RansomEXX REvil Ryuk SDBbot SmokeLoader TrickBot Zloader
2021-01-25 ⋅ Medium CSIS Techblog ⋅ Benoît Ancel
The Nemty affiliate model
Nemty
2021-01-01 ⋅ Secureworks ⋅ SecureWorks
Threat Profile: GOLD MANSARD
Nefilim Nemty GOLD MANSARD
2020-07-29 ⋅ ESET Research ⋅ welivesecurity
THREAT REPORT Q2 2020
DEFENSOR ID HiddenAd Bundlore Pirrit Agent.BTZ Cerber ClipBanker CROSSWALK Cryptowall CTB Locker DanaBot Dharma Formbook Gandcrab Grandoreiro Houdini ISFB LockBit Locky Mailto Maze Microcin Nemty NjRAT Phobos PlugX Pony REvil Socelars STOP Tinba TrickBot WannaCryptor
2020-05-04 ⋅ SentinelOne ⋅ Jim Walter
Meet NEMTY Successor, Nefilim/Nephilim Ransomware
Nefilim Nemty
2020-04-02 ⋅ McAfee ⋅ Alexandre Mundo, Marc Rivero López
Nemty Ransomware – Learning by Doing
Nemty
2020-03-24 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Three More Ransomware Families Create Sites to Leak Stolen Data
Clop DoppelPaymer Maze Nefilim Nemty REvil
2020-02-18 ⋅ Lastline ⋅ Jason Zhang, Stefano Ortolani
Nemty Ransomware Scaling UP: APAC Mailboxes Swarmed by Dual Downloaders
Nemty Phorpiex
2020-01-10 ⋅ Github (albertzsigovits) ⋅ Albert Zsigovits
Nemty ransomware
Nemty
2019-11-04 ⋅ Symantec ⋅ Eduardo Altares, Muhammad Hasib Latif, Nguyen Hoang Giang
Nemty Ransomware Expands Its Reach, Also Delivered by Trik Botnet
Nemty Phorpiex
2019-10-10 ⋅ Tesorion ⋅ Frank van den Hurk
Nemty update: decryptors for Nemty 1.5 and 1.6
Nemty
2019-10-10 ⋅ Bleeping Computer ⋅ Lawrence Abrams
Nemty Ransomware Decryptor Released, Recover Files for Free
Nemty
2019-09-17 ⋅ Fortinet ⋅ Joie Salvio
Nemty Ransomware 1.0: A Threat in its Early Stage
Nemty
2019-09-08 ⋅ Bleeping Computer ⋅ Ionut Ilascu
Fake PayPal Site Spreads Nemty Ransomware
Nemty
2019-09-03 ⋅ Bleeping Computer ⋅ Ionut Ilascu
Nemty Ransomware Gets Distribution from RIG Exploit Kit
Nemty
2019-08-26 ⋅ Bleeping Computer ⋅ Ionut Ilascu
New Nemty Ransomware May Spread via Compromised RDP Connections
Nemty
2019-08-24 ⋅ Github (k-vitali) ⋅ Vitali Kremez
Notes on Nemty Ransomware
Nemty
Yara Rules
[TLP:WHITE] win_nemty_auto (20260504 | Detects win.nemty.)
rule win_nemty_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.nemty."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nemty"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 730e 8d4d24 eb09 80392b 7503 c6012e }
            // n = 6, score = 300
            //   730e                 | jae                 0x10
            //   8d4d24               | lea                 ecx, [ebp + 0x24]
            //   eb09                 | jmp                 0xb
            //   80392b               | cmp                 byte ptr [ecx], 0x2b
            //   7503                 | jne                 5
            //   c6012e               | mov                 byte ptr [ecx], 0x2e

        $sequence_1 = { 7405 e8???????? 83c61c 897510 83c31c 895d08 }
            // n = 6, score = 300
            //   7405                 | je                  7
            //   e8????????           |                     
            //   83c61c               | add                 esi, 0x1c
            //   897510               | mov                 dword ptr [ebp + 0x10], esi
            //   83c31c               | add                 ebx, 0x1c
            //   895d08               | mov                 dword ptr [ebp + 8], ebx

        $sequence_2 = { a1???????? 33c5 8945fc 8d85f4fdffff 50 33c0 }
            // n = 6, score = 300
            //   a1????????           |                     
            //   33c5                 | xor                 eax, ebp
            //   8945fc               | mov                 dword ptr [ebp - 4], eax
            //   8d85f4fdffff         | lea                 eax, [ebp - 0x20c]
            //   50                   | push                eax
            //   33c0                 | xor                 eax, eax

        $sequence_3 = { 85c0 7453 83ec1c 03cb }
            // n = 4, score = 300
            //   85c0                 | test                eax, eax
            //   7453                 | je                  0x55
            //   83ec1c               | sub                 esp, 0x1c
            //   03cb                 | add                 ecx, ebx

        $sequence_4 = { 83c410 834dfcff 8b4304 8945e4 8b0b }
            // n = 5, score = 300
            //   83c410               | add                 esp, 0x10
            //   834dfcff             | or                  dword ptr [ebp - 4], 0xffffffff
            //   8b4304               | mov                 eax, dword ptr [ebx + 4]
            //   8945e4               | mov                 dword ptr [ebp - 0x1c], eax
            //   8b0b                 | mov                 ecx, dword ptr [ebx]

        $sequence_5 = { ff15???????? 53 8d459c 50 ff35???????? }
            // n = 5, score = 300
            //   ff15????????         |                     
            //   53                   | push                ebx
            //   8d459c               | lea                 eax, [ebp - 0x64]
            //   50                   | push                eax
            //   ff35????????         |                     

        $sequence_6 = { 8bc3 e8???????? eb23 ff759c }
            // n = 4, score = 300
            //   8bc3                 | mov                 eax, ebx
            //   e8????????           |                     
            //   eb23                 | jmp                 0x25
            //   ff759c               | push                dword ptr [ebp - 0x64]

        $sequence_7 = { 8db5b4fcffff e8???????? 53 8db57cfcffff }
            // n = 4, score = 300
            //   8db5b4fcffff         | lea                 esi, [ebp - 0x34c]
            //   e8????????           |                     
            //   53                   | push                ebx
            //   8db57cfcffff         | lea                 esi, [ebp - 0x384]

        $sequence_8 = { 7507 be???????? eb2b 83f802 7507 be???????? eb1f }
            // n = 7, score = 300
            //   7507                 | jne                 9
            //   be????????           |                     
            //   eb2b                 | jmp                 0x2d
            //   83f802               | cmp                 eax, 2
            //   7507                 | jne                 9
            //   be????????           |                     
            //   eb1f                 | jmp                 0x21

        $sequence_9 = { 837d3810 8bf8 8b4524 59 7303 8d4524 837d3810 }
            // n = 7, score = 300
            //   837d3810             | cmp                 dword ptr [ebp + 0x38], 0x10
            //   8bf8                 | mov                 edi, eax
            //   8b4524               | mov                 eax, dword ptr [ebp + 0x24]
            //   59                   | pop                 ecx
            //   7303                 | jae                 5
            //   8d4524               | lea                 eax, [ebp + 0x24]
            //   837d3810             | cmp                 dword ptr [ebp + 0x38], 0x10

    condition:
        7 of them and filesize < 204800
}
Download all Yara Rules