Exte Ransomware

The Exte Ransomware is an update of the 'Azer' branch of Cryptmix Ransomware, which uses an AES algorithm to lock your files and secures the conversion with another layer of RSA encoding. Attacks of this type can block content perpetually unless you're able to restore them from an uninfected backup or find an appropriate decryption program. Because of the high level of file damage possible with this threat, malware experts recommend blocking the Exte Ransomware preemptively with anti-malware tools or removing it as soon as possible with the same.

Listening to the Latest Trojan Mix

Whether due to other parties hiring its services or the original authors being interested in long-term update cycles, the family of Cryptomix or the CryptMix Ransomware isn't done growing. The last major revision to this family that malware analysts are verifying is the Exte Ransomware, which, according to its encoding method, is a new variant of the Azer line. Most of the Exte Ransomware's changes are cosmetic, and the Trojan shows no indications of being any less efficient than usual at blocking file data for money.

In a routine that avoids symptoms that could alert the user, the Exte Ransomware uses an AES cipher to block different formats of data on the infected PC. Although this AES encoding routine could be vulnerable to decoding, the Trojan selects one of a small list of ten RSA keys to use for secondary encryption. This behavior is similar to Azer-based variants of the Cryptmix Ransomware and sharply different from that of MOLE Ransomware.

Differences in the Exte Ransomware's payload include:

• The Exte Ransomware adds a new '.EXTE' extension onto the filenames of every file it locks.
• The Exte Ransomware uses a different ransom note, both regarding its name and its contents. However, the threat actors are retaining the core instructions of similar campaigns, such as generating an ID for each attack and using dedicated e-mail addresses as the ransom negotiating channels for selling their file-unlocking decryptor.

Keeping the Cryptmix Ransomware's Youngster Off the Charts

Although any locked content uses the '.EXTE' extensions for flagging purposes, the rest of the name also is encoded, which can make identifying individual files difficult for the victim. While some members of the Exte Ransomware's family are open to decryption by third parties, this fact isn't applicable to all variants. Because there is always a possibility that the encryption is unbreakable, malware analysts advise that you make regular backups of your content to secure drives.

The Exte Ransomware first began being seen in the middle of July, and its infection vectors remain under examination. A PC can be compromised through multiple means, although threat actors using Trojans like the Exte Ransomware often prefer spam e-mails or browser-based exploits for installation purposes. Most anti-malware products should block and delete the Exte Ransomware at this stage although they also may quarantine or remove the Exte Ransomware after an attack.

While some aspects of the Exte Ransomware's ransoming infrastructure are updating, the Trojan's underlying code appears to be reliably profitable, for now. PC owners should do their best to limit those profits by backing up media of value and using safe Web-browsing habits at all times.

Technical Details