Nefilim

According to Vitali Kremez and Michael Gillespie, this ransomware shares much of the code with Nemty 2.5. The difference is the removal of the RaaS component, which has been replaced by email communications for payments. Uses AES-128, which is then protected by RSA2048.