New Exte CryptoMix Ransomware Variant Released

Yesterday, Malwarebytes malware researcher Marcelo Rivero discovered a new variant of the CryptoMix ransomware that is appending the .EXTE extension to encrypted file names. This article provides a brief summary of information related to this new variant.

As we are always looking for weaknesses, if you are a victim of this variant and decide to pay the ransom, please send us the decryptor so we can take a look at it. You can also discuss or receive support for Cryptomix ransomware infections in our dedicated Cryptomix Help & Support Topic.

Changes in the Exte Cryptomix Ransomware Variant

While overall the encryption methods stay the same in this variant, there have been some differences. First and foremost, we have a new ransom note with a file name of _HELP_INSTRUCTION.TXT. This ransom note contains instructions to contact either exte1@msgden.net, exte2@protonmail.com, or exte3@reddithub.com for payment information.

The next noticeable change is the extension appended to encrypted files. With this version, when a file is encrypted by the ransomware, it will modify the filename and then append the .EXTE extension to encrypted file’s name. For example, an test file encrypted by this variant has an encrypted file name of 32A1CD301F2322B032AA8C8625EC0768.EXTE.

One point of interest, is that this variant continues to use the same 10 public RSA keys as the previous AZER version. One of these keys will be selected to encrypt the AES key used to encrypt a victim’s files. This allows the ransomware to work completely offline with no network communication.

As this is just a cursory analysis of this new variant, if anything else is discovered, we will be sure to update this article.

IOCs

File Hashes:

SHA256: 6211fdd680208f94aa0149619facc0de8b51e6cb98108132d539469f3affa712

Filenames associated with the Exte Cryptomix Variant:

_HELP_INSTRUCTION.TXT
%AppData%\[random].exe

Exte Ransom Note Text:

Hello!

Attention! All Your data was encrypted!

For specific informartion, please send us an email with Your ID number:

exte1@msgden.net

exte2@protonmail.com

exte3@reddithub.com

We will help You as soon as possible!


DECRYPT-ID-[victim_id] number

Emails Associated with the Exte Ransomware:

exte1@msgden.net
exte2@protonmail.com
exte3@reddithub.com

Bundled Public RSA-1024 Keys:

Alisa Esage G

Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.

New Exte CryptoMix Ransomware Variant Released

Changes in the Exte Cryptomix Ransomware Variant

IOCs

File Hashes:

Filenames associated with the Exte Cryptomix Variant:

Exte Ransom Note Text:

Emails Associated with the Exte Ransomware:

Bundled Public RSA-1024 Keys:

WinRAR and ZIP File Exploits: This ZIP File Hack Could Let Malware Bypass Your Antivirus

5 Techniques Hackers Use to Jailbreak ChatGPT, Gemini, and Copilot AI systems

This Hacker Toolkit Can Breach Any Air-Gapped System – Here’s How It Works

Hacking Pagers to Explosions: Israel’s Covert Cyber-Physical Sabotage Operation Against Hezbollah!

Five Techniques for Bypassing Microsoft SmartScreen and Smart App Control (SAC) to Run Malware in Windows

How Millions of Phishing Emails were Sent from Trusted Domains: EchoSpoofing Explained

How to implement Principle of Least Privilege(Cloud Security) in AWS, Azure, and GCP cloud

The 11 Essential Falco Cloud Security Rules for Securing Containerized Applications at No Cost

Cyber Security Channel