A threat actor shares a ransomware builder named Nevermore Ransomware Builder on a dark web forum. According to the post, attackers can customize the builder and upload their own instructions, desired wallpapers and custom icons.
The threat actor also indicates that the ransomware builder gives two encryption modes. One of them only encrypts the filenames while the other one encrypts everything. For further customization attackers can also choose how to receive the ransom. They can pick the desired wallet and the crypto coin.
Another feature of the ransomware builder is “File Stealer” which allows attackers to download victims’ files before encrypting them. According to the post, every payload is unique and the ransomware is advertised as fully undetectable by Windows Defender.
Price or contact information is not provided.
