- Jul 22, 2014
- 2,525
CryptoMix is releasing new variants very quickly now and is reminiscent of how the Locky developers used to distribute Locky. Yesterday, ID-Ransomware's Michael Gillespie & Malwarebytes malware researcher Marcelo Rivero discovered two new variants of the CryptoMix ransomware being distributed within a week or two of each other. These variants append either the NOOB or ZAYKA extension to encrypted files, but use the same contact email of admin@zayka.pro for payment instructions.
As we are always looking for weaknesses, if you are a victim of this variant and decide to pay the ransom, please send us the decryptor so we can take a look at it. You can also discuss or receive support for Cryptomix ransomware infections in our dedicated Cryptomix Help & Support Topic.
Changes in the NOOB and ZAYKA Cryptomix Ransomware Variants
Not much has changed with the Noob and Zayka variants other then the ransom note contents and the bundled public encryption keys. Both of these variants use a ransom note with a file name of _HELP_INSTRUCTION.TXT. This ransom note contains instructions to contact admin@zayka.pro for payment instructions.
The first variant using the zayka.pro email is NOOB and comes with a very basic ransom note.
....
As we are always looking for weaknesses, if you are a victim of this variant and decide to pay the ransom, please send us the decryptor so we can take a look at it. You can also discuss or receive support for Cryptomix ransomware infections in our dedicated Cryptomix Help & Support Topic.
Changes in the NOOB and ZAYKA Cryptomix Ransomware Variants
Not much has changed with the Noob and Zayka variants other then the ransom note contents and the bundled public encryption keys. Both of these variants use a ransom note with a file name of _HELP_INSTRUCTION.TXT. This ransom note contains instructions to contact admin@zayka.pro for payment instructions.
The first variant using the zayka.pro email is NOOB and comes with a very basic ransom note.
....
