XZZX Ransomware

Posted: November 14, 2017

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	8/10
Infected PCs:	33

First Seen:	April 20, 2021
Last Seen:	March 2, 2022
OS(es) Affected:	Windows

The XZZX Ransomware is a member of the CryptMix Ransomware family (also identifiable as 'CryptoMix'). This Trojan uses embedded cryptography keys to encode and lock different file types, such as pictures or documents. Symptoms related to an infection include specific changes to the names of any unusable, digital media, as well as ransom-themed messages soliciting the victim to buy a decryptor. Use your anti-malware programs to delete the XZZX Ransomware proactively, when possible, and backups for recovering any files that this Trojan damages.

Mixing Up a New Edition of Trojans

November finally is seeing a new 'birth' in the CryptMix Ransomware family, which is notable for switching between offline and online cryptography attacks and conducting RaaS-based extortion campaigns. The new member, the XZZX Ransomware, is an offline variant and is suitable for holding data on a PC hostage without requiring any form of network connection, although it still requiring manual installation to the system. Although the XZZX Ransomware's changes are superficial predominantly, its activity is a reminder to readers that the CryptMix Ransomware family is both highly active and, potentially, flexible with its threat actors.

The XZZX Ransomware uses internal storage of its keys that allows the program to conduct RSA-secured, AES-based, file-locking attacks against arbitrary types of media. Commonplace targets of these attacks usually include text documents, byproducts of popular software like Adobe's PDF Reader or Microsoft's Office suite, images and archives. After locking all of this content, the XZZX Ransomware converts their names with Base64 (resulting in the appearance of semi-random numbers and letters), along with adding its '.XZZX' extension.

The XZZX Ransomware also generates a ransom message that the threat actors update from previous versions only for which e-mail addresses it uses. Like other CryptMix Ransomware versions, the XZZX Ransomware gives the victim an ID number for the process of 'buying' the decryption solution to unlocking their files. Victims pay this ransom at their own risk and may not be provided with the decryption key afterward.

Ending the Danger of the End of the Alphabet

Since the XZZX Ransomware's family may cycle through different threat actors arbitrarily, its installation exploits have the potential to be more flexible than those of most file-locking Trojans. Malware experts often see Trojans of the XZZX Ransomware's classification using spam e-mail attachments as favored delivery mechanisms, but manual attacks using RDP features or even fake, pirated media downloads also are possible vectors for an infection. Updating anti-malware solution to use their latest available databases for identifying new threats can help them detect inaccurate files that pose a threat to your computer.

The XZZX Ransomware's family has features intended for deleting local backups that the user could use to restore any 'locked' content. As a precaution against similar attacks, malware experts suggest always keeping a backup on a secure device, such as USB drives, DVDs or cloud services. Most modern iterations of the XZZX Ransomware's family, including the XZZX Ransomware, use secure encryption methods that aren't compatible with currently-available, public decryptors. However, anti-malware products always may remove the XZZX Ransomware immediately and minimize any file loss.

The CryptMix Ransomware family continues growing, and members like the XZZX Ransomware, the Coban Ransomware, and the Shark Ransomware represent a rotation of very similar threats to the most valuable files on your computer. Without an unexpected breakthrough in its RSA database by malware experts, the price of letting your backups grow disused might be everything on your hard drive.

XZZX Ransomware

Threat Metric

Mixing Up a New Edition of Trojans

Ending the Danger of the End of the Alphabet

Leave a Reply