CryptoMix
Aliases: Zeta, Azer, CryptFile2
- First seen
- 2016-03-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Last IoC activity
- 2026-06-24 07:45:04
- Profile updated
- 2026-07-07 15:42:31
Targeted industries: healthcare-and-pharmaceutical financial-services government-and-public-sector education-and-nonprofits
Context
CryptoMix is a ransomware family known for encrypting files on infected systems and demanding a ransom for decryption keys. It has been distributed via various methods, often targeting healthcare and other critical industries.
Detection coverage
- 2 YARA rules
Detection rules
- CAPE_Azer (yara-rule)
- MALPEDIA_Win_Cryptomix_Auto (yara-rule)
Related threat objects
- CryptoMix-Arena (malware)
- CryptoMix-Error (malware)
- Cryptomix-SERVER (malware)
- CryptoMix-Wallet (malware)
- Cryptomix-WORK (malware)
- CryptoMix-x1881 (malware)
- CryptoMix-XZZX (malware)
- CryptoMix-Zayka (malware)
- CryptoMix-0000 (malware)
- CryptoMix-Azer (malware)
- CryptoMix-Backup (malware)
- CryptoMix-CK (malware)
- CryptoMix-Coban (malware)
- CryptoMix-DLL (malware)
- CryptoMix-Empty (malware)
- CryptoMix-Exte (malware)
- Cryptomix-FILE (malware)
- CryptoMix-MOLE66 (malware)
- CryptoMix-Noob (malware)
- CryptoMix-Ogonia (malware)
- CryptoMix-Pirate (malware)
- CryptoMix-Revenge (malware)
- CryptoMix-Shark (malware)
- CryptoMix-System (malware)
- CryptoMix-Tastylock (malware)
Reports & references
- nyxbone.com — Cryptomix (report)
- cert.pl — Technical Analysis Of Cryptomixcryptfile2 Ransomware (report)
- twitter.com — 804009831518572544 (report)
- bleepingcomputer.com — New Empty Cryptomix Ransomware Variant Released (report)
- bleepingcomputer.com — 0000 Cryptomix Ransomware Variant Released (report)
- bleepingcomputer.com — Xzzx Cryptomix Ransomware Variant Released (report)
- bleepingcomputer.com — Test Cryptomix Ransomware Variant Released (report)
- bleepingcomputer.com — Work Cryptomix Ransomware Variant Released (report)
- bleepingcomputer.com — System Cryptomix Ransomware Variant Released (report)
- bleepingcomputer.com — Mole66 Cryptomix Ransomware Variant Released (report)
- bleepingcomputer.com — New Backup Cryptomix Ransomware Variant Actively Infecting Users (report)
- twitter.com — 1072227523755470848 (report)
- coveware.com — Cryptomix Ransomware Exploits Cancer Crowdfunding (report)
- bleepingcomputer.com — Cryptomix Ransomware Exploits Sick Children To Coerce Payments (report)
- labs.sentinelone.com — Breaking Ta505S Crypter With An Smt Solver (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Cryptomix (report)
- bleepingcomputer.com — New Azer Cryptomix Ransomware Variant Released (report)