- Home
- Detectable Ransomware
- CryptoMix-Wallet
Ransomware Research
CryptoMix-Wallet Ransomware
CryptoMix-Wallet is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on April 1, 2017, this ransomware has been actively targeting systems worldwide. Security researchers also track this malware under the aliases: Wallet, CryptoMix-Wallet.
Quick Facts
- Ransomware Family
- CryptoMix-Wallet
- First Seen
- April 1, 2017
- Known Aliases
- WalletCryptoMix-Wallet
How CryptoMix-Wallet Ransomware Works
Targeted Files
Encrypt filenames magic.mgc -> ZNTVP.ZTP.[SHIELD0@USA.COM].ID[000038F1C63F241F].WALLET
File Encryption Patterns
CryptoMix-Wallet modifies encrypted files using specific patterns to mark them as encrypted:
File extensions added after encryption:
..wallet
Ransom Note and Payment Demands
After encrypting files, CryptoMix-Wallet displays ransom notes demanding payment for file recovery:
#_RESTORING_FILES_#.TXT
Ransom message:
notes/#_RESTORING_FILES_#.TXT
Note locations:
EveryFolder
Technical Indicators
Associated Executable Files
The following executable files are associated with CryptoMix-Wallet ransomware:
adobe_1233452.exe
Solheim&Sørensen AS
monsendas.exe
8dc1f63089a3363715436feabca1c05cf6ff0505d20426a27665258e21aeadd9.8dc1f63089a3363715436feabca1c05cf6ff0505d20426a27665258e21aeadd9
moldensang.exe
Elastio Can Help You
Don't let CryptoMix-Wallet ransomware take over your data
Elastio provides advanced ransomware protection and recovery solutions to keep your organization safe.
About This Analysis
This CryptoMix-Wallet ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery solutions, helping organizations defend against and recover from ransomware attacks like CryptoMix-Wallet.
Last updated: July 30, 2025