New Exte CryptoMix Ransomware Variant Released

Yesterday, Malwarebytes malware researcher Marcelo Rivero discovered a new variant of the CryptoMix ransomware that is appending the .EXTE extension to encrypted file names. This article provides a brief summary of information related to this new variant.

As we are always looking for weaknesses, if you are a victim of this variant and decide to pay the ransom, please send us the decryptor so we can take a look at it. You can also discuss or receive support for Cryptomix ransomware infections in our dedicated Cryptomix Help & Support Topic.

Changes in the Exte Cryptomix Ransomware Variant

While overall the encryption methods stay the same in this variant, there have been some differences. First and foremost, we have a new ransom note with a file name of _HELP_INSTRUCTION.TXT. This ransom note contains instructions to contact either exte1@msgden.net, exte2@protonmail.com, or exte3@reddithub.com for payment information.

The next noticeable change is the extension appended to encrypted files. With this version, when a file is encrypted by the ransomware, it will modify the filename and then append the .EXTE extension to encrypted file’s name. For example, an test file encrypted by this variant has an encrypted file name of 32A1CD301F2322B032AA8C8625EC0768.EXTE.

One point of interest, is that this variant continues to use the same 10 public RSA keys as the previous AZER version. One of these keys will be selected to encrypt the AES key used to encrypt a victim’s files. This allows the ransomware to work completely offline with no network communication.

As this is just a cursory analysis of this new variant, if anything else is discovered, we will be sure to update this article.

IOCs

File Hashes:

SHA256: 6211fdd680208f94aa0149619facc0de8b51e6cb98108132d539469f3affa712

Filenames associated with the Exte Cryptomix Variant:

_HELP_INSTRUCTION.TXT
%AppData%\[random].exe

Exte Ransom Note Text:

Hello!

Attention! All Your data was encrypted!

For specific informartion, please send us an email with Your ID number:

exte1@msgden.net

exte2@protonmail.com

exte3@reddithub.com

We will help You as soon as possible!


DECRYPT-ID-[victim_id] number

Emails Associated with the Exte Ransomware:

exte1@msgden.net
exte2@protonmail.com
exte3@reddithub.com

Bundled Public RSA-1024 Keys:

Alisa Esage G

Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.

New Exte CryptoMix Ransomware Variant Released

Changes in the Exte Cryptomix Ransomware Variant

IOCs

File Hashes:

Filenames associated with the Exte Cryptomix Variant:

Exte Ransom Note Text:

Emails Associated with the Exte Ransomware:

Bundled Public RSA-1024 Keys:

The 11 Essential Falco Cloud Security Rules for Securing Containerized Applications at No Cost

Hack-Proof Your Cloud: The Step-by-Step Continuous Threat Exposure Management CTEM Strategy for AWS & AZURE

Web-Based PLC Malware: A New Technique to Hack Industrial Control Systems

The API Security Checklist: 10 strategies to keep API integrations secure

11 ways of hacking into ChatGpt like Generative AI systems

How to send spoof emails from domains that have SPF and DKIM protections?

Silent Email Attack CVE-2023-35628 : How to Hack Without an Email Click in Outlook

How to Bypass EDRs, AV with Ease using 8 New Process Injection Attacks

Cyber Security Channel