Summary: [/subscribe_to_unlock_form]
Summary: [emaillocker id="1283"]
A new variation of the ransomware called "Mallox" or "TargetCompany" has emerged, which appends the file extension ".malox" to encrypted files instead of the previous extension ".mallox." This ransomware gained attention for its unique method of adding the targeted company's name as a file extension. The new variant is distributed using BatLoader and spreads Remote Access Trojans (RATs) and stealers. Unlike the previous version, it injects the ransomware payload into "MSBuild.exe" without saving it on the disk, eliminating the need for a downloader. Mallox ransomware has affected over 20 victims in more than 15 countries, with India and the United States being the primary targets. The Manufacturing, Energy & Utilities, IT & ITES, and Professional Services industries have been the most affected.
The initial infection of the Mallox ransomware occurs when a user clicks on a spam email attachment, which can either be an executable file downloading BatLoader from a remote server or directly containing BatLoader. The ransomware utilizes an obfuscated batch script that executes commands. It first checks if the IS_MINIMIZED environment variable is defined and, if not, starts the same batch script in a minimized window. It then copies the PowerShell executable to a file with the same name as the batch script but with the ".exe" extension. The system and hidden attributes are set for the copied PowerShell file.
Infection Chain
The PowerShell script, executed with parameters, extracts the ransomware payload from BatLoader by scanning for lines containing the substring "ck" and appending the following substring to an object. The PowerShell script also drops a batch script called "killerrr.bat" in the %TEMP% directory, which can perform various operations such as killing processes, stopping services, disabling services, deleting services, and removing directories. The PowerShell script dynamically loads the Mallox assembly by loading it from a byte array.It retrieves the entry point of the assembly and creates an instance of it. Unlike previous variants, this ransomware appends encrypted files with the ".malox" extension.
The Mallox ransomware group has integrated BatLoader into their operations, enabling them to extract and inject the ransomware payload. This loader exhibits similarities to those used in the distribution of other malware families. The adoption of new infection techniques indicates that the threat actors behind Mallox ransomware are actively adjusting their tactics to improve evasion and sustain their malicious activities. This highlights the need for organizations to remain vigilant and employ robust cybersecurity measures to protect against evolving ransomware threats.
Threat Profile:
| Tactic | Technique Id | Technique |
| Execution | T1204 | User Execution |
| Defense Evasion | T1140 | Deobfuscate/Decode Files or Information |
| T1562 | Impair Defences | |
| T1222 | File and Directory Permissions Modification | |
| T1564 | Hidden Files and Directories | |
| T1036 | Masquerading | |
| T1070 | File Deletion | |
| Discovery | T1082 | System Information Discovery |
| T1083 | File and Directory Discovery | |
| Impact | T1486 | Data Encrypted for Impact |
| Command and Control | T1071 | Application Layer Protocol |
References:
The following reports contain further technical details:
https://blog.cyble.com/2023/06/22/mallox-ransomware-implements-new-infection-strategy/
[/emaillocker]