Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
Ransomware group

Mallox ransomware

10 victims listed on the Mallox leak site across 8 countries. Most recent disclosure .

Victims
10
0% of all tracked
Countries
8
Most: Germany
Sectors
5
Most: Business Services
First seen
Mar 2024
In this database

ThreatAI analysis

Compiled from the ransomware.live profile for Mallox and from this database. Figures and technique mappings are quoted from the source data, not inferred.

Who Mallox is

This ransomware uses a combination of different crypto algorithms (ChaCha20, AES-128, Curve25519). The activity of this malware is dated to mid-June 2021. The extension of the encrypted files are set to the compromised company: .

Recorded activity

Disclosures attributed to Mallox in this database run from March 2024 to July 2024, totalling 10 victims — 0% of everything tracked here. Mallox has listed victims in 8 countries in this database, most often Germany, followed by India and Argentina. The sectors appearing most in its listings are Business Services, Technology, Agriculture and Food Production.

Tooling observed in Mallox operations

  • Dropmefiles
  • File[.]io
  • Sendspace

Software reported in use by Mallox. Most are legitimate administration or transfer utilities; their presence in an environment is a signal to investigate, not proof of compromise.

Indicators of compromise

Showing a sample of 2 EMAIL on file. Hashes and network indicators published for Mallox. Leak-site addresses are deliberately excluded. Indicators age quickly — treat a match as a starting point for investigation, and an absence of matches as no assurance.

YARA detection rules

mallox.yar 
rule ransomware_mallox {
    meta:
        id = "7e2edc94-26e4-4024-8bc0-8e90d76f5a96"
        version = "1.0"
        description = "Rule to detect mallox ransomware samples."
        author = "Sekoia.io"
        creation_date = "2023-02-20"
        modification_date = "2023-05-24"
        classification = "TLP:CLEAR"
        hash1 = "2a549489e2455a2d84295604e29c727dd20d65f5a874209840ce187c35d9a439"
        hash2 = "3f843cbffeba010445dae2b171caaa99c6b56360de5407da71210d007fe26673"
        hash3 = "4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6"
        hash4 = "4db69a0643f6ec795e5450a0563605e91293f233aa60715ae09ed8effa3b7267"
        hash5 = "77fdce66e7f909300e4493cbe7055254f7992ba65f9b7445a6755d0dbd9f80a5"
        hash6 = "8e974a3be94b7748f7971f278160a74d738d5cab2c3088b1492cfbbd05e83e22"
        hash7 = "a5085e571857ec54cf9625050dfc29a195dad4d52bea9b69d3f22e33ed636525"
        hash8 = "df64e87ecb30f4cadf54f2c1b3d3cba8cc2d315db0fd4af2d11add57baa56f6a"
        hash9 = "e7e00e0f817fcb305f82aec2e60045fcdb1b334b2621c09133b6b81284002009"
        
    strings:
        $s1 = "C:\\HOW TO RECOVER !!.TXT" wide ascii nocase
        $s2 = "SYSTEM\\CurrentControlSet\\Services\\EventLog\\Application\\Raccine" wide ascii nocase
        $s3 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\vssadmin.exe" wide ascii nocase
        $s4 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\wmic.exe" wide ascii nocase
        $s5 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\wbadmin.exe" wide ascii nocase
        $s6 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\bcdedit.exe" wide ascii nocase
        $s7 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\powershell.exe" wide ascii nocase
        $s8 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\diskshadow.exe" wide ascii nocase
        $s9 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\net.exe" wide ascii nocase
        $s10 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\taskkill.exe" wide ascii nocase
        $s11 = "bcdedit /set {current} recoveryenabled no" wide ascii nocase
        $mallox_fargo = ".FARGO" wide ascii nocase
        $mallox_mallox = ".mallox" wide ascii nocase
        $mallox_exploit = "[email protected]"
        
    condition:
        uint16be(0) == 0x4d5a and all of ($s*) and 1 of ($mallox_*)
}

Community-contributed rules for Mallox, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.

Threat actor analysis

Mallox has disclosed 10 victims on its leak site, 0% of all ransomware listings tracked in this database. Its earliest disclosure here dates to March 2024.

The group has listed organisations in 8 countries, most often in Germany (1 victims), followed by India, Argentina, Italy.

By industry, its listings concentrate in Business Services, Technology, Agriculture and Food Production — sectors that hold sensitive data or cannot tolerate long outages, both of which raise the pressure to pay.

Like most current ransomware operations, Mallox is likely to use double extortion: data is stolen before files are encrypted, and organisations that refuse to pay are named on the leak site with the stolen data as leverage.

Generated from public leak-site disclosures aggregated via the ransomware.live API and updated automatically.

Mallox victims 10

Organization Disclosed
integraservices
XENAPP-GLOBER
"Moshe Kahn Advocates"
ILIsrael
Madata Data Collection & Internet Portals
MXMexico
Río Negro
ARArgentina
Assist Informatica
ITItaly
speditionlangen.de
DEGermany
highfashion.com.hk
HKHong Kong
Rafum Group
PKPakistan
Ramdev Chemical Industries
INIndia

Frequently asked questions

What is Mallox ransomware?

Mallox is a ransomware threat group that has claimed 10 victims since its first known activity in March 2024. The group operates by infiltrating target networks, exfiltrating data, encrypting files, and threatening to publish stolen data on a dark web leak site if the ransom is not paid.

How many victims has Mallox attacked?

Mallox has claimed 10 victims in our database, representing 0% of all tracked ransomware attacks. The most targeted countries are Germany, India, Argentina, Italy.

Which countries does Mallox target?

Mallox has attacked organizations in 8 countries. The top targeted countries are: Germany, India, Argentina, Italy.

Which industries does Mallox target?

Mallox most frequently targets the Business Services, Technology, Agriculture and Food Production sectors based on victim disclosures in our database.

Is Mallox still active?

Mallox's most recent victim disclosure in our database was on July 15, 2024. Ransomware groups frequently rebrand or go dormant; monitor this page and our ransomware map for the latest activity.