targetcompany | 55a35e274170365cb002d6fb694f02fe5b69311aa610b4979166e48057c12191

General

Target

17541178989.zip
Size

7.4MB
Sample

240603-lcsp7aaa4z
MD5

b4398714fb1d346cc679d102787a5c53
SHA1

8c54de012ecddac388d2425961c2f2546c776975
SHA256

55a35e274170365cb002d6fb694f02fe5b69311aa610b4979166e48057c12191
SHA512

7d4ab8ee326a3194ef407579df35538f0392a856eb0e25c70014f28f2c7d17c9f48af3bd7d1b087b87bf66742c1278bf1374bc2b3d6a0d6be1a52c9df298cf99
SSDEEP

196608:fE/SXiVnsgof1qg9CVpXNfPi+OyF34YXoCKv5Ou7264kLM:fCSSV4tIr0DvvCKxOfx

Score

10^/10

Malware Config

Extracted

Path

C:\HOW TO BACK FILES.txt

Ransom Note

Hello Your data has been stolen and encrypted We will delete the stolen data and help with the recovery of encrypted files after payment has been made Do not try to change or restore files yourself, this will break them We provide free decryption for any 3 files up to 3MB in size on our website How to contact with us: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: B9AA0BBAF8CCB382CDE37D2C 5) You will see chat, payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion �

URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Extracted

Path

\Device\HarddiskVolume1\HOW TO BACK FILES.txt

Ransom Note

Hello Your data has been stolen and encrypted We will delete the stolen data and help with the recovery of encrypted files after payment has been made Do not try to change or restore files yourself, this will break them We provide free decryption for any 3 files up to 3MB in size on our website How to contact with us: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: C20BBF8E22A6E8D22DF798B4 5) You will see chat, payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion �

URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Targets

- Target
  
  d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08
- Size
  
  544KB
- MD5
  
  d201bd19e60d500963aff0c235b07727
- SHA1
  
  341552a8650d2bdad5f3ec12e333e3153172ee66
- SHA256
  
  d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08
- SHA512
  
  4afa7da1bf2a86dc9a3b94b674ecffea638304c42c43c955631bbe29c605be673b7182ed1fcb8997c55c6bbd2a48e5ec46177e8327e9e903781d1ffb2abd991c
- SSDEEP
  
  6144:h0wmbI4/Z4SHvrxw6zaIST1w9wEPDasWxxsBhS37b8o6XCFyPwCMa6qnXxq/y:Gzv66zaISTW9asWxxAh4IlXC4PUqBq/
Score

10^/10

targetcompany evasion execution ransomware
- TargetCompany,Mallox
  TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
  ransomware targetcompany
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (7262) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2