Mallox is a ransomware operation targeting Windows systems, leveraging unsecured MS-SQL servers as an entry point and using brute-force techniques to gain access. It employs a double-extortion model, steals data before encryption, and is expanding via affiliate recruitment. #Mallox #TargetCompany
Keypoints
- Mallox specifically targets unsecured MS-SQL servers to gain initial access.
- The group uses dictionary brute-forcing followed by PowerShell-based payload delivery to deploy the ransomware.
- It operates a double-extortion scheme, stealing data before encrypting files and threatening public release.
- The ransomware encrypts files with ChaCha20 and appends various extensions (e.g., .malox, .FARGO3, .xollam) and leafs ransom notes on each directory.
- Mallox attempts to evade defenses by stopping SQL-related services, deleting volume shadow copies, clearing logs, and tampering with permissions and recovery tools.
- Affiliates recruitment on hacking forums (e.g., Ramp and nulled.to) suggests a push toward ransomware-as-a-service expansion.
- Protection recommendations emphasize patching, EDR/XDR deployment, threat hunting, and monitoring for credential- and process-based abuse.
MITRE Techniques
- [T1110] Brute Force – Used a dictionary brute force attack against MS-SQL servers to gain initial access. ‘dictionary brute force attack, trying a list of known or commonly used passwords against the MS-SQL servers.’
- [T1059.001] PowerShell – Download and execute the ransomware payload via PowerShell. “powershell -ExecutionPolicy Bypass C:UsersMSSQLS~1AppDataLocalTempupdt.ps1”
- [T1105] Ingress Tool Transfer – Download of the ransomware payload from a remote server. “Downloads the ransomware payload from: hxxp://80.66.75[.]36/aRX.exe”
- [T1136] Create Account – Creation of a new user account (SystemHelp) to facilitate access. “The tzt.bat file is used to create a user named SystemHelp”
- [T1021.001] Remote Services – Enabling remote desktop protocol (RDP) to facilitate remote access. “enable the remote desktop (RDP) protocol”
- [T1543.003] Windows Service – Stop and remove SQL-related services via sc.exe and net.exe, modifying services to aid encryption. “Attempts to stop and remove SQL-related services using sc.exe and net.exe”
- [T1070.001] Clear Windows Event Logs – Erasing logs to hinder detection. “to thwart detection and forensic analysis efforts” via wevtutil
- [T1222.001] File and Directory Permissions Modification – Altering permissions with takeown.exe to deny access. “Modifies file permission using the Windows built-in takeown.exe command”
- [T1490] Inhibit System Recovery – Deleting volume shadow copies to prevent file restore. “Deletes volume shadows, making it harder to restore files once they are encrypted.”
- [T1112] Modify Registry – Removing security tool traces (Raccine) by deleting registry keys. “by deleting its registry key.”
- [T1486] Data Encrypted for Impact – Encrypting files with ChaCha20 and appending extensions. “encrypts files using the ChaCha20 encryption algorithm and appends the .malox extension”
- [T1041] Exfiltration – Data exfiltration as part of double-extortion. “stealing data before encrypting an organization’s files, and then threatening to publish the stolen data”
Indicators of Compromise
- [SHA256] Mallox sample hashes – 6c743c890151d0719150246382b5e0158e8abc4a29dd4b2f049ce7d313b1a330, b03f94c61528c9f3731a2e8da4975c072c9ed4e5372d3ec6b0939eebe01e54a4
- [PowerShell scripts] Updt.ps1 and Upddt.ps1 hashes – dcc9e23fd6ac926eb9ee7e0ee422dacd2059b4a42c8642d32bdf4f5c8eb33f6a, fead3d518752ddb4d2407f16ca5f3c9b3c0bf01972a2618369d02913f7c6af1a
- [System.bat] hashes – 1e2515efb64200258752d785863fd35df6039441a80cb615dfff4fbdffb484ec, 777a5782426e5b42e0e5e8445dd9602d123e8acc27aca4daa8e9c053f3d5b899
- [IP] Mallox activity IPs – 103.96.72[.]140, 80.66.75[.]36
Read more: https://unit42.paloaltonetworks.com/mallox-ransomware/