NUURI Ransomware is a Phobos Variant that Modifies File Extensions

During our investigation of file samples, our team of malware researchers uncovered a new ransomware called NURRI. Further analysis revealed that NURRI is part of the Phobos ransomware family. This malicious software encrypts files and modifies their filenames by adding the ".NURRI" extension, along with the victim's ID and an email address (nury_espitia@tuta.io). Additionally, NURRI leaves two ransom notes, namely "info.hta" and "info.txt."

To illustrate how NURRI renames encrypted files, let's take an example: a file originally named "1.jpg" would be changed to "1.jpg.id[9ECFA84E-3352].[nury_espitia@tuta.io].NURRI," while "2.png" would become "2.png.id[9ECFA84E-3352].[nury_espitia@tuta.io].NURRI," and so on.

The ransom note explains that all files have been encrypted due to a security issue on the user's computer. It provides an email address (nury_espitia@tuta.io) and an ID for contacting the attackers to initiate the process of file restoration. The ransom payment, demanded in Bitcoins, varies depending on how quickly the user contacts the attackers.

The note also mentions an option for the user to send up to three files for free decryption as a guarantee. It advises against renaming the encrypted files or using third-party decryption software to avoid permanent data loss or falling victim to scams. The second ransom note ("info.txt") includes additional contact information, such as a Telegram username (@HostUppp).

NUURI Ransom Note Asks for Bitcoin Ransom

The full text of the NUURI ransom note reads as follows:

All your files have been encrypted!
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail nury_espitia@tuta.io
Write this ID in the title of your message -
If you do not receive a response within 24 hours, please contact us by Telegram.org account: @HostUppp
You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files.
Free decryption as guarantee
Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
hxxps://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
hxxp://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

How Can You Protect Your Data from Ransomware Attacks Similar to NUURI?

Protecting your data from ransomware attacks like NURRI requires a proactive approach and a combination of preventive measures. Here are some steps you can take to enhance your data security:

• Backup your data: Regularly back up your important files to an offline or cloud storage solution. Ensure that the backups are encrypted and verify their integrity periodically.
• Keep software up to date: Install updates and patches for your operating system, applications, and security software. These updates often include important security fixes that can protect against known vulnerabilities.
• Use robust security software: Install and maintain reputable antivirus/anti-malware software on all your devices. Keep it updated and perform regular scans to detect and remove any potential threats.
• Exercise caution with email attachments and downloads: Be cautious when opening email attachments or downloading files from untrusted or suspicious sources. Avoid clicking on links in unsolicited emails and be wary of downloading files from unverified websites.
• Enable strong security settings: Utilize built-in security features such as firewalls and pop-up blockers to add an extra layer of protection. Enable automatic scanning of email attachments and downloads for malware.
• Educate yourself and your staff: Stay informed about the latest phishing techniques and social engineering tactics used in ransomware attacks. Train yourself and your employees to identify and avoid suspicious emails, links, and attachments.
• Enable macro security: Disable macros in office applications by default and only enable them when necessary. Be cautious when prompted to enable macros in documents from unknown or untrusted sources.
• Use strong, unique passwords: Implement strong, complex passwords for all your accounts and avoid reusing passwords across multiple platforms. Consider using a password manager to securely store and generate unique passwords.
• Enable two-factor authentication (2FA): Enable 2FA whenever possible to add an extra layer of security. This requires users to provide an additional verification method, such as a unique code sent to their mobile device, along with their password.