RTMLocker Ramsomware (N3ww4v3/Mimic)

Hi guys, yesterday a client was infected with this ransomeware.

Today I have access to this pc and get samples files, and found log from the virus and a  folder where operate it.

In a internal tool I see this additional command excution where set the password.

net user admin Qweasd!1

Log folder location:

c:\temp

Log folder contain:

MIMIC_LOG.txt

session.tmp

Virus Tools Folder Location:

c:\users\"USER"\appdata\local\0F983A3D-FC63-C07E-6477-E3A5238DEF4B

Virus Tools Folder Content:

7za.exe

DC.exe

ENC_default_default_2023-12-27_09-27-40=Telegram@datadecrypt.exe

Everything.exe

Everything.ini

Everything2.ini

Everything32.dll

Everything64.dll

global_options.ini

gui35.exe

gui40.exe

rtmlocker.exe

session.tmp

xdel.exe

Rescue note name:

rtmlocker_DECRYPTION.txt

Rescue note content:

Edited by quietman7, 22 March 2024 - 07:09 AM.

What is the actual name of the ransom note? 
 
RTM Locker (Read The Manual Locker) ransomware
RTM Locker Ransomware: In-Depth Analysis, Detection, and Mitigation
Linux version of RTM Locker ransomware targets VMware ESXi servers

Looking at this line which includes a long string of alpha-numerical characters comprising a PERSONAL DECRYPTION ID with an asterisk (*)

YOUR PERSONAL DECRYPTION ID - 85-Ws1GO20K9PY4_UdCE78b67Uek9DwXHshValgIYDg*exe

...this could be a new variant of N3ww4v3/Mimic Ransomware which has been known to use such a pattern/format and sometimes reported to include a MIMIC_LOG.txt. 

 
Was .exe the file extension appended to the end of your encrypted data files?

Your posted rtmlocker_DECRYPTION.txt ransom note content:

RTM Locker Description 

https://www.uptycs.com/blog/rtm-locker-ransomware-as-a-service-raas-linux

There is no known method that I am aware of to decrypt files encrypted by N3ww4v3/Mimic Ransomware without paying the ransom (not advisable) and obtaining the private encryption keys from those who created the ransomware unless they are leaked or seized & released by authorities.

The criminal's master private key is needed for decryption. Without the criminal's master private key, decryption is impossible. That usually means the key is unique (specific) for each victim and generated in a secure way (RSA, AES, Salsa20, ChaCha20, EDA2, ECDH, ECC) that cannot be brute-forced...the public key alone that encrypted files is useless for decryption.

Edited by hibrid0, 21 March 2024 - 01:22 PM.

Edited by hibrid0, 21 March 2024 - 02:57 PM.

Looking at this line which includes a long string of alpha-numerical characters comprising a PERSONAL DECRYPTION ID with an asterisk (*)

YOUR PERSONAL DECRYPTION ID - 85-Ws1GO20K9PY4_UdCE78b67Uek9DwXHshValgIYDg*exe

...this could be a new variant of N3ww4v3/Mimic Ransomware which has been known to use such a pattern/format and sometimes reported to include a MIMIC_LOG.txt. 

 
Was .exe the file extension appended to the end of your encrypted data files?

yes, of course, this is a Mimic in all respects: the content of the ransom note, the log during the encryption process, the composition of the encryptor files, and the characteristic directory where the encryptor files are located.

I also think it's a Mimic Ransomware

https://www.virustotal.com/gui/file/8816bf5056a42f20cdd42209bf7553be1bd6d41eef6562976afcddde37b0abff

@hibrid0

There is an ongoing discussion in this topic where victims can post comments, ask questions and seek further assistance. Other victims have been directed there to share information, experiences and suggestions.

• N3ww4v3/Mimic Ransomware (.n3ww4v3; [random 5-15 char]) Support Topic

Rather than have everyone with individual topics, it would be best (and more manageable for staff) if you posted any more questions, comments or requests for assistance in the above support topic discussion...it includes experiences by experts, IT consultants, victims and company representatives who have been affected by ransomware infections. To avoid unnecessary confusion, this topic is closed.
 
Thanks
The BC Staff