Mallox

Mallox is a ransomware strain that targets Microsoft (MS) Windows systems. It was first identified in June 2021 and compromises networks with vulnerable MS-SQL servers. Mallox ransomware infects victim computers through emails, software cracking tools that bypass license activation, and downloads from unknown sites. Mallox is designed to encrypt files on the infected system and appends the “.mallox” extension to file names. For example, the file name “sample.txt” becomes “sample.txt.mallox”. Some other Mallox variants append extensions such as “.malox”, “.malloxx”, or “.maloxx” to encrypted files. It also creates a ransom note named “RECOVERY INFORMATION.txt”, containing instructions for contacting the attacker. The demanded ransom is provided when the victim accesses the Mallox ransomware TOR website using a Tor Browser.