Categories: NewsSecurity

CryptFile2 Ransomware Obfuscates Infected Files’ Extension to Avoid Decryption

It appears a lot of existing ransomware strains are undergoing some much-needed upgrades as of late. The developers of CryptoMix variant CryptFile2 have introduced some noteworthy changes. All encrypted files will now receive a new file extension, which causes more problems for malware victims. After all, they can no longer easily identify which type of ransomware infected their system in the first place.

CryptFile2 Ransomware Strain makes Life More Difficult

As if victims of malware attacks do not have enough to worry about already, the people responsible for creating CryptFile2 decided to up the ante a bit. Most types of ransomware infections can be easily identified by looking at the encrypted file’s extension. However, the updated CryptoMix variant now removes the proprietary file extension and renames files to the “.wallet” extension. A rather surprising turn of events that will have major consequences.

As a result of this change, malware victims can no longer identify the type of ransomware harming their system. In a way, this should improve the chance of getting paid where criminals are concerned. However, it remains to be seen if the .wallet extension will trick more people into paying the ransom demand due to this change. Consumers are well aware of how paying the ransom is never the right answer.

However, one thing that may cause a problem is how multiple types of malware now use the .wallet extension. CryptFile2 is just one of the many variants to do so, as Dharma, Sanctions, and a few other types of malware use this extension as well. Moreover, one cannot go by the email address listed to communicate with the criminals either, as they show no hint of which malware type is involved.

Related Post

Decrypting files with the .wallet extension is impossible at this stage, unfortunately. It does not matter which ransomware is responsible for the infection, as security engineers have not been able to create a free decryptor for any of the malware types using this extension right now. It is possible a free tool will be made available in the future, though, but for now, restoring data from a backup is the most viable course of action.

As one would come to expect these days, CryptFile2 spreads itself through many different ways. Unfortunately, there is no clear pattern to be detected, which makes it rather difficult for researchers to warn the public about this new threat. Spam emails, malicious Torrent downloads, and malicious links spread via social media are the most likely distribution methods at this stage, though.

What sets CryptFile2 apart from other types of ransomware is how it does not only encrypt specific file extensions. Instead, the malware goes after any file as long as they are not found within specifically whitelisted folders. The criminals will offer free decryption of up to five files to prove they actually control the decryption key for each individual victim. There is no fixed Bitcoin fee associated with decrypting files either, as it will all depend on when the victim contacts the developers.

If you liked this article, follow us on Twitter @themerklenews and make sure to subscribe to our newsletter to receive the latest bitcoin, cryptocurrency, and technology news.

JP Buntinx

JP Buntinx is a FinTech and Bitcoin enthusiast living in Belgium. His passion for finance and technology made him one of the world's leading freelance Bitcoin writers, and he aims to achieve the same level of respect in the FinTech sector.

Share
Published by
JP Buntinx

Recent Posts

TRX Price Prediction: Tron Network Fee Cut to Spark New ATH?

Back into Spotlight: Tron Network Fee Cut Could Push TRX to ATH, But This DeFi…

8 hours ago

Altcoin Alert: Crypto Market Cap Breaches Key Level Hinting at an 8000x Rally for this Shiba Inu Killer

Shiba Inu (SHIB) gave enormous returns in 2021, making many early holders millionaires. After the…

12 hours ago

XRP Crash? XRP Falls Below $0.5 Resistance Level as Next Gen Altcoin JetBolt Takes Over

Spooky season might be over but doom is still looming as Ripple’s XRP falls below…

15 hours ago

This New Exchange Token Is Poised for a Price Surge Alongside Cardano and Avalanche – Analysts Predict Huge Gains This November

Three promising altcoins are causing a stir among investors this November: Avalanche (AVAX), Cardano (ADA),…

15 hours ago

With Dogecoin Dipping and TRON Holding, Is Lunex the Hottest Crypto Now?  

Everyone knows what the hottest crypto can do. When it was so hot it was…

15 hours ago

Tron Fees To Be Cut In Half Through Proposal 95, Cutoshi Surpasses $600k As TRX Investors Join CUTO Presale

The Tron network has witnessed incredible growth in several areas, especially in its adoption, which…

16 hours ago