NMoreira Ransomware Data Recovery

Written byHeloise Montini
Heloise Montini

Heloise Montini is a content writer whose background in journalism make her an asset when researching and writing tech content. Also, her personal aspirations in creative writing and PC gaming make her articles on data storage and data recovery accessible for a wide audience.

Edited byLaura Pompeu
Laura Pompeu

With 10 years of experience in journalism, SEO & digital marketing, Laura Pompeu uses her skills and experience to manage (and sometimes write) content focused on technology and business strategies.

Co-written byBogdan Glushko
Bogdan Glushko

CEO at SalvageData Recovery, Bogdan Glushko has over 18 years of experience in high-security data recovery. Over the years, he's been able to help restore data after logical errors, physical failures, or even ransomware attacks, for individuals, businesses, and government agencies alike.

I think there's an issue with my storage device, but I'm not sure
Start a free evaluation

NMoreira and NMoreira 2.0 are two variants of the same ransomware that was first seen in early 2017. NMoreira is file-encrypting ransomware that is designed to encrypt the victims' files using AES-256 encryption. Once the files are encrypted, the NMoreira Ransomware will display a ransom note that demands a ransom be paid to decrypt the files. NMoreira 2.0 Ransomware is very similar to NMoreira; however, it uses a different encryption algorithm and employs different tactics to spread itself.NMoreira is usually spread through email attachments or fraudulent websites. Once the malicious email attachment is opened, this ransomware will begin to encrypt the victim's files. It will append the ".locked" extension to the encrypted files and will create a ransom note named "README.txt" in each directory that contains encrypted files. The ransom note will contain instructions on how to decrypt the files and will demand that a ransom be paid in Bitcoin.NMoreira 2.0 Ransomware is spread similarly to NMoreira; however NMoreira 2.0 Ransomware uses AES-128 encryption instead of AES-256 encryption. NMoreira 2.0 will also prepend the ".locked" extension to the encrypted files and will create a ransom note named "README.txt" in each directory that contains encrypted files. As with NMoreira Ransomware, the ransom note will contain instructions on how to decrypt the files and will demand that a ransom be paid in Bitcoin.

What types of files do NMoreira and NMoreira 2.0 Ransomware encrypt?

NMoreira and NMoreira 2.0 will primarily target personal files, such as documents, photos, and videos. However, it is also capable of encrypting certain types of business files, such as databases and spreadsheets.

Protection

There are several things you can do to protect yourself from NMoreira and NMoreira 2.0 Ransomware:- Use a reliable anti-malware program with real-time protection.- Keep your operating system and other software up-to-date.- Avoid opening email attachments from unknown senders.- Avoid downloading or opening files from untrustworthy websites.- Backup your important files regularly.If you follow these tips, you will reduce your risk of becoming a victim of NMoreira Ransomware and NMoreira 2.0 Ransomware. However, no protection is 100% effective, so you should always be prepared for the worst by having a backup of your important files. That way, if you do become a victim of ransomware, you can restore your files from the backup and avoid having to pay the ransom.

How much is the ransom?

The ransom demanded by NMoreira Ransomware is usually 1 Bitcoin, which is currently equivalent to approximately $9,500. The ransom demanded by NMoreira 2.0 Ransomware is usually 0.5 Bitcoin, which is currently equivalent to approximately USD 4,750.But the ransom amount can vary depending on the negotiation between the victim and the attacker.

How much time do I have to pay the ransom?

The NMoreira Ransomware gives victims 72 hours to pay the ransom, while NMoreira 2.0 Ransomware gives victims 24 hours to pay the ransom. If the victim does not pay the ransom within the allotted time, the price will double.If you do not pay the ransom, your files will remain encrypted and you will not be able to access them. Additionally, NMoreira will delete all the shadow copies of your files, which will make it impossible to recover your files without paying the ransom.So, if you become a victim of NMoreira Ransomware or NMoreira 2.0 Ransomware, you should immediately do the following things:

  • Do not pay the ransom.
  • Use anti-malware software to remove the ransomware from your computer.
  • Restore your files from a backup, if you have one.

Paying the ransom will not guarantee that you will get your files back. There are many cases where victims who paid the ransom did not get their files decrypted. Additionally, by paying the ransom, you will be supporting the attackers financially and encouraging them to continue their malicious activities. The best course of action is to remove the ransomware from your computer using anti-malware software and restore your files from a backup if you have one.

Public decryption tool

Emsisoft has created a free decryption tool for NMoreira Ransomware. This tool can decrypt files encrypted by NMoreira Ransomware without paying the ransom.To use the tool, you need to have at least one encrypted file and the corresponding unencrypted file. The tool will use the unencrypted file to decrypt the encrypted file.Emsisoft’s NMoreira Ransomware Decryption Tool is available for free from their website.There is no 100% guarantee that this tool will work, but it is worth a try if you have been infected by NMoreira Ransomware and you do not want to pay the ransom. Unfortunately, there is no public decryption tool available for NMoreira 2.0 Ransomware at this time.

Contact a data recovery service

If you do not have a backup of your files and you cannot decrypt your files using the free decryption tool, you can try contacting a data recovery service. Data recovery services specialize in recovering data from encrypted files and may be able to help you recover your files.If you decide to use a data recovery service, you should only use a reputable service and you should be prepared to pay.SalvageData has a good reputation for recovering data from encrypted files and they offer a free evaluation to see if they can recover your files.Since 2003, they have recovered data for over 60,000 businesses and individuals in over 70 countries. Their prices are reasonable and they offer a no-risk guarantee, which means you only pay if they can recover your data.You can contact SalvageData by filling out their online form or by calling them at +1 (800) 972-3282.

Share this article

Related services

These are the most commonly requested data recovery services. At our headquarters' cleanroom lab, our certified engineers conduct a thorough review of any type of physical storage device, determining if there is logical or physical damage and carefully restoring all of the lost files.ces.

External Drive Data Recovery

We recover data from both external SSD and HDD drives. Rely on certified experts to restore your important files from damaged or corrupted external drives.

/services/data-recovery/external-drive/

Hard Drive Data Recovery

Recover data from all brands of HDD, PC hard drives, and hybrid disks. Our specialists ensure fast and secure recovery for any data loss scenario.

/services/data-recovery/hard-drive/

NAS Data Recovery

Recover data from NAS devices, including RAID configurations. Our team handles all types of NAS systems and ensures data recovery with minimal downtime.

/services/data-recovery/nas/

RAID Data Recovery

Our RAID data recovery services cover RAID 0, 1, 5, 10, and other configurations. We offer expert solutions for failed, degraded, or corrupted RAID arrays.

/services/data-recovery/raid/

SAN Data Recovery

Our team specializes in handling SAN devices from leading manufacturers like Dell EMC, HP, and IBM, ensuring efficient recovery with minimal disruption to your operations.

/services/data-recovery/san/

SD Card Data Recovery

Our recovery experts specialize in restoring data from SD and memory cards. We guarantee quick recovery with a no-data, no-charge policy.

/services/data-recovery/sd-card/

SSD Data Recovery

Our data recovery experts handle all SSD data loss scenarios with advanced tools, ensuring maximum recovery with high-security protocols.

/services/data-recovery/ssd/

USB Flash Drive Data Recovery

Recover lost data from USB flash drives, regardless of the damage or brand. We offer free in-lab evaluations to assess data recovery needs.

/services/data-recovery/usb-flash-drive/

If you’re unsure about which data recovery service to choose, let our team assist you in selecting the appropriate solutions. We understand the anxiety that comes with a sudden drive failure, and we are more prompt in our actions compared to other recovery service providers.