N3ww4v3/Mimic Ransomware ([random 5-15 char] or <email> ext) Support Topic

Files that are encrypted with many N3ww4v3/Mimic Ransomware variants will have a random 5-15 alpha-numerical character extension appended to the end of the encrypted data filename as explained here by Amigo-A (Andrew Ivanov). These are some examples of random character extensions.

.n3ww4v3
.g0eI9
.r0Qp@3M
.1cy931cn9v
.h777XRgNVM777xM
.2n1d4b4fv3

Other variants of N3ww4v3/Mimic append a specific extension or an email address to the end of the encrypted data filename to include the following.

.crypt, .hicrypt, .HONESTBITCOIN, .Fora, .Hairysquid, .PORTHUB, .QUIETPLACE, .bigspermhorseballs, .KASPERSKY, .shiverer, .darth, .Indianguy, .HONEYHORSELIKESMONEY, .dataland. .processcrypt, .FreeWorldEncryption, .PISCOSTRUI, .PANIN, .PODSTAVLIAIPOPKU, .0nk1udlu, .TeaMp0ison, .GREEDYFATHER, .Telegram@datadecrypt, .exe, .NEEDTOPAYTOMYHORSE, .WORM, .ELPACO-team 
.
.damarans@mail.ru.damarans, .pisunellakonososeila@onionmail.org, .anilorak@onionmail.org, .showrans@mail.ru.show, .thaihorsebleepers@onionmail.org, .nemorans@mail.ru.NemoRans, .backmydata@inbox.ru.1000USD, .getmydata@list.ru.3000USDAA, .backmydata@inbox.ru.2000USD, .decryptboss@gmail.com.terminator

N3ww4v3/Mimic Ransomware typically will leave files (ransom notes) with various names to include How-to-decrypt.txt, Instructions.txt, What_happened_read_me.txt, HOW_TO_DECRYPT.txt, How-to-Decrypt.txt, === Readme.txt, README.txt, ----Read-Me-----.txt, Decrypt_me.txt, ---IMPORTANT---NOTICE---.txt, Contact-Note.txt, CONTACT.txt, Comunicacin.txt, READ_ME_MY_FRIEND.txt, Instruction.txt, DECRYPTION_INFO, NEED_PAYMENT_README.TXT, OMO_OMO_Decryption.txt, ---BILGILENDIRME----NOTU---.txt, Amigodainapasik_Decryption.txt, rtmlocker_DECRYPTION.txt.
 
A few variants use ransom notes which include the encrypted data extension as part of it's name.

Bigspermhorseballs_Decryption.txt
Kaspersky_Decryption.txt
INDIANGUY_DECRYPTION.txt
Anilorak_Decryption.txt
FreeWorld-Contact.txt
PISCOSTRUI.txt
Decrypt_ELPACO-team_INFO.txt
Datadecrypt.txt

In addition, some N3ww4v3/Mimic Ransomware variants create special files such as info.txt, hashlist.txt, and MIMIC_LOG.txt.
 
N3ww4v3/Mimic ransom notes are known to include a long string of alpha-numerical-special characters comprising a DECRYPTION ID/CODE (decrypt ID, unique ID, personal ID, Encryption Number, Contact number, REFERENCE CODE) with an asterisk (*) followed by the same extension which is appended to encrypted data files as shown in these examples.

Your decrypt ID is: lpQdH_qHD4LmEC7Hrrt208Pc5ce_aNHNF98mJEeDkwI*9niOpX
Your unique ID is: O28KRMGjKkx_zW7J2TdbdzDe7VluLemi5bv_C9vu7Ww*giapk33vw
Your personal ID: AeqHaNqpUgaHkbEGl7YUpt-e3DTpEWVzY5Q5xus9-kI*ul8dlsj86v
Your decryption ID is J_KD34VkcUChOpAtpmdZzyVD4BzO6NPlIfAjJwa3N28*ELPACO-team
YOUR PERSONAL DECRYPTION ID - n7EJLCWmjqOlSi_BzAUDAwfnFqL8LjRjmAOQkgCXcmU*GREEDYFATHER
Encryption Number : 4L3hC49ng92fRIFuIipkrUXTTVy4v4J8rLPwCELRDlI*dataland
Contact number : NyCu17SY6OqCw60FvjvYTpaKQn0zGQwXY9Uwj_sXDjI*FreeWorldEncryption

=> REFERENCE ID <=

WJ0p65ktdcOdTrV7wZ8n1aMJQ4ap8RRVag2ejxKQjDI*decryptboss@gmail.com.terminator

=> YOUR REFERENCE CODE <=
fgUT3IBc6PpX0s890hZs5N6BXQ4WTyuwIGoH60mAmVs*getmydata@list.ru.3000USDAA

 
 
 
Has anyone come across this new ransomware, the file extension is .n3ww4v3?
 
It leaves a text file named "How-to-decrypt" that pops up when you login.

A ransom note and several encrypted files must be attached to the message in the zip archive.

Edited by Amigo-A, 01 August 2022 - 10:09 AM.

Amigo-A

Here's the link to the text file

https://mega.nz/file/Ec93jQQZ#e1DhrbKjwTC1YXUvO5okYFOT40L6-tRHppjOU1cnQxs

Hi, 

Have any news about this new ransomware ? 

Today i face down with this ransomware and searching more info about that. 

Just a note file is not enough. Need encrypted files to view.

The previous person did not provide them.

I add 3 files like example ( pdf, jpg ) and text file with text "how to decrypt " with all info and decrypt ID,  to 7zip archive 

We transfer link to download https://we.tl/t-xOB4TlYatw

It's funny that the ransomware note you uploaded is different from the one the previous person uploaded. 

I think I can link this case to one of the previous ones, but if the actors is related to the previous extortion group, the ransomware itself may already be different.

Yes you right text in note is different  that previous person uploaded. 

Is there any possibility to get a decrypt tool to this ransomware someday ? 

I think is new ransomware because i can't find any information about this encryption with   " n3ww4v3 " extension. 

Other strange thing is that some folders is missing files just empty, looks like they stolen or hiden.  

Reference this case SHA1: c4537ed7c40707d6dea38e5ad9010b57e02a84c2

Please help to have a look.

extension: n3ww4v3

Edited by jasonmak, 31 August 2022 - 01:47 AM.

I have merged your topic into the primary support topic for victims of this ransomware.

Hello, Is there anyone can help on this

Our crypto malware experts most likely will need a sample of the malware file itself to analyze before the type of infection can be confirmed and ascertain if the encrypted files can even be decrypted. 
 
If you can find the malicious executable that you suspect was involved in causing the infection, you can submit (upload) a sample to VirusTotal and provide a link to the results...this is the safest way of sharing malware since only vetted researchers can access it. Doing that may be helpful with analyzing, investigating, identification of the ransomware and possibly finding a flaw which could be useful for decryption of encrypted data. Refer to my comments in this topic for the most common locations malicious executables are know to hide.