targetcompany | d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08

General

Target

Reader.img
Size

544KB
Sample

240909-ybl78swdlm
MD5

d201bd19e60d500963aff0c235b07727
SHA1

341552a8650d2bdad5f3ec12e333e3153172ee66
SHA256

d6629a9b618ede05e9e75a2cebfb69bc7b1a34fe00a42ff60d88828a307c0d08
SHA512

4afa7da1bf2a86dc9a3b94b674ecffea638304c42c43c955631bbe29c605be673b7182ed1fcb8997c55c6bbd2a48e5ec46177e8327e9e903781d1ffb2abd991c
SSDEEP

6144:h0wmbI4/Z4SHvrxw6zaIST1w9wEPDasWxxsBhS37b8o6XCFyPwCMa6qnXxq/y:Gzv66zaISTW9asWxxAh4IlXC4PUqBq/

Score

10^/10

Malware Config

Extracted

Path

C:\HOW TO BACK FILES.txt

Ransom Note

Hello Your data has been stolen and encrypted We will delete the stolen data and help with the recovery of encrypted files after payment has been made Do not try to change or restore files yourself, this will break them We provide free decryption for any 3 files up to 3MB in size on our website How to contact with us: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: 5EF6F91DF9299D2D996DF9E6 5) You will see chat, payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion �

URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Extracted

Path

\Device\HarddiskVolume1\HOW TO BACK FILES.txt

Ransom Note

Hello Your data has been stolen and encrypted We will delete the stolen data and help with the recovery of encrypted files after payment has been made Do not try to change or restore files yourself, this will break them We provide free decryption for any 3 files up to 3MB in size on our website How to contact with us: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: CC41F0584A0CC3EDE5F16A6D 5) You will see chat, payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion �

URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Targets

- Target
  
  Reader.lnk
- Size
  
  2KB
- MD5
  
  66bb9363e23c7ef2d16c89cd654b491e
- SHA1
  
  c20e8d536804cf97584eec93d9a89c09541155bc
- SHA256
  
  61f36c5ae038faa2b58a9a17b464d01414b4265e46634f353319c471d0a35789
- SHA512
  
  b7a751e49218230d574ca9cc4cbbb1995d89798268124b1617889c7558c66902f81fdb77a299edcc6d96452cec81adb76768172710e00c9272d30821ab0089c5
Score

9^/10

evasion execution ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  
  red.exe
- Size
  
  478KB
- MD5
  
  71efe7a21da183c407682261612afc0f
- SHA1
  
  0f1aea2cf0c9f2de55d2b920618a5948c5e5e119
- SHA256
  
  45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d
- SHA512
  
  3cff597dbd7f0d5ab45b04e3c3731e38626b7b082a0ede7ab9a7826921848edb3c033f640da2cb13916febf84164f7415ca9ac50c3d927f04d9b61fcadb7801c
- SSDEEP
  
  6144:W0wmbI4/Z4SHvrxw6zaIST1w9wEPDasWxxsBhS37b8o6XCFyPwCMa6qnXxq/y:7zv66zaISTW9asWxxAh4IlXC4PUqBq/
Score

10^/10

targetcompany evasion ransomware discovery
- TargetCompany,Mallox
  TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
  ransomware targetcompany
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (7245) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral3 behavioral4