Security experts spotted a new variant of the CryptoMix ransomware that uses a different extension (.FILE) to append to the file names of the encrypted files and uses new contact emails. The ransom note is still named _HELP_INSTRUCTION_TXT, but the contact emails to receive the payment instructions are [email protected] and [email protected], [email protected]. The new variant uses the same encryption methods of previous ones.”]
Source: http://securityaffairs.co/wordpress/67103/malware/file-cryptomix-ransomware.html