MalwareHunterTeam has discovered a new variant of the Cryptomix Ransomware that adds the .MOLE66 extension to encrypted files, changes the contact email and the .txt file.
In the past, we used to see new variants of Cryptomix 2-3 times a month, but this time it has been about 2 months since the release of its previous variant.
While the encryption methods remain the same, there have been some minor differences. The name of the .txt file has been renamed to _HELP_INSTRUCTIONS_.TXT and it now uses the email alpha2018a@aol.com to contact the victim for payment information.
The next notable change is the extension appended to encrypted files. In this version, when a file is encrypted by Cryptomix, the file name will be modified and then the .MOLE66 to the encrypted file name.
We remind you of the ways to protect yourself from malicious software
- BACKUP! The first and most important step is to create backups.
- Don't open attached files if you don't know what they contain
- Verify the sender, as in many cases the email account of someone you know may have been hacked and malicious messages may be sent without their knowledge.
- Scanning attached files with tools like VirusTotal
- Make sure that all Windows updates are installed as soon as they are released! Also, make sure that all the programs you use are up to date. Out-of-date software may contain security vulnerabilities that are commonly exploited by malicious users. Therefore, it is important to keep them updated.
- Make sure you are using some security software (antivirus, antimalware) which should be updated on a daily basis.
- Create passwords with a combination of letters, numbers, and symbols, and don't reuse the same password across multiple websites.
