New Azer CryptoMix Ransomware Variant Released

Lawrence Abrams

July 5, 2017
05:15 PM
0

Today has been busy with ransomware and we have some some good news coming later today. For this story, though, we are going to take a look at the Azer variant of the Cryptomix ransomware. This version of Cryptomix was discovered today by security researcher MalwareHunterTeam right as a decryptor for the previous version, Mole02, was released.

While this ransomware encrypts files in a similar manner to all others in this family, I did notice some changes in this version that will be outlined below.

As we are always looking for weaknesses, if you are a victim of this variant and decide to pay the ransom, please send us the decryptor so we can take a look at it. You can also discuss or receive support for Cryptomix ransomware infections in our dedicated Cryptomix Help & Support Topic.

Changes in the Azer Cryptomix Ransomware Variant

While overall the encryption methods stay the same in this variant, there have been some differences. First and foremost, we have a new ransom note with a file name of _INTERESTING_INFORMACION_FOR_DECRYPT.TXT. This ransom note contains instructions to contact either webmafia@asia.com or donald@trampo.info for payment information.

The next noticeable change is the extension appended to encrypted files. With this version, when a file is encrypted by the ransomware, it will modify the filename and then append the string -email-[email_address].AZER to the encrypted file. For example, an test file encrypted by this variant has an encrypted file name of 32A1CD301F2322B032AA8C8625EC0768-email-[webmafia@asia.com].AZER.

Last, but not least, this version performs no network communication and is completely offline. It also embeds ten different RSA-1024 public encryption keys, which are listed below. One of these keys will be selected to encrypt the AES key used to encrypt a victim's files. This is quite different compared to the Mole02 variant, which only included one public RSA-1024 key.

As this is just a cursory analysis of this new variant, if anything else is discovered, we will be sure to update this article.

IOCs

File Hashes:

SHA256: 6f5f3bd509c22f0aec4a55fd4d08b7527be4708145b760bc3bd955c6e7538064

Filenames associated with the Azer Cryptomix Variant:

_INTERESTING_INFORMACION_FOR_DECRYPT.TXT
%AppData%\[random].exe

Azer Ransom Note Text:

 All you files encrypted
 For decrypt write to email:
 webmafia@asia.com
 donald@trampo.info
 You ID - XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX

Emails Associated with the Azer Ransomware:

webmafia@asia.com
donald@trampo.info

Bundled Public RSA-1024 Keys:

New Azer CryptoMix Ransomware Variant Released

Lawrence Abrams

Changes in the Azer Cryptomix Ransomware Variant

IOCs

File Hashes:

Filenames associated with the Azer Cryptomix Variant:

Azer Ransom Note Text:

Emails Associated with the Azer Ransomware:

Bundled Public RSA-1024 Keys:

Lawrence Abrams

Post a Comment Community Rules

You need to login in order to post a comment

Login

New Azer CryptoMix Ransomware Variant Released

Lawrence Abrams

Changes in the Azer Cryptomix Ransomware Variant

Related Articles:

IOCs

File Hashes:

Filenames associated with the Azer Cryptomix Variant:

Azer Ransom Note Text:

Emails Associated with the Azer Ransomware:

Bundled Public RSA-1024 Keys:

Lawrence Abrams

Post a Comment Community Rules

You need to login in order to post a comment

You may also like:

Reporter

Help us understand the problem. What is going on with this comment?