Ransomware family
Mallox Ransomware Decryption & Data Recovery
- Active
- Critical
- Some versions decryptable
Mallox (also known as TargetCompany) breaks in mainly through brute-forced MS SQL Server credentials, targets database servers specifically, and has a Linux/ESXi variant. Files encrypted between 2023 and early 2024 may be decryptable with Avast's free tool; later builds have no public decryption method.
- First seen
- 2021-06
- File extensions
- .mallox .malox .mallab
- Ransom notes
- FILE RECOVERY.txt
- Affected platforms
- Windows / Linux / VMware ESXi / Databases
Family profile
- File extensions
- .mallox
- .malox
- .mallab
- .malloxx
- .ma1x0
- .xollam
- .bitenc
- .FARGO3
- .locked（Linux / ESXi 变种）
- Ransom notes
- FILE RECOVERY.txt
- HOW TO BACK FILES.txt
- HOW TO RESTORE FILES.txt
- RECOVERY INFORMATION.txt
- Contact patterns
- Tor negotiation portal (.onion, victim ID login)
- Disposable mailboxes (onionmail.org and similar domains)
- Mallox leak site (.onion, no new posts since July 2024, long offline)
- Aliases / versions
- TargetCompany、FARGO、Tohnichi、Xollam、Water Gatpanapun、Mallox RaaS
- First seen
- 2021-06
- Status
- Active
- Threat level
- Critical
- Affected platforms
- Windows
- Linux
- VMware ESXi
- Databases
- Tags
- Prevalent in China
- Ransomware-as-a-Service
- Double extortion
- Targets databases
- Targets virtualization
- Exploits vulnerabilities
- Active
Avast (Gen Digital) found a cryptographic flaw in early Mallox builds and published a free decryptor. Its scope is narrow and specific:
- Applies only to files encrypted between 2023 and early 2024.
- Covers the extensions .bitenc, .ma1x0, .mallab, .malox, .mallox, .malloxx and .xollam.
- The operators fixed the flaw around March 2024, so files encrypted by later builds cannot be decrypted with this tool.
The decisive factor is therefore when encryption happened, not the extension itself. Mallox activity after March 2024, including the TargetCompany Linux/ESXi variant, has no public decryption method. According to Gen Digital's October 2024 notes, the tool must run on the same computer where the encryption happened; take a full backup of the encrypted files first and confirm usable output before bulk processing.
Latest activity
As of 2026-09-11, ransomware.live and ransomlook.io show no Mallox leak-site posts since 2024-07-15 and 0% .onion uptime: the brand is dormant and pressure has shifted to Weaxor. Backups and DB repair are the path.
Sources
Overview
Mallox appeared in June 2021 and is tracked under several names for the same lineage — TargetCompany, FARGO, Tohnichi (Trend Micro names the actor cluster Water Gatpanapun, with Mallox as the leak-site brand). Its defining trait is that database servers are the primary target: entry comes from brute-forcing the MS SQL Server sa account, then executing system commands through database components to drop the payload. Unit 42 observed activity growing by nearly 174% year over year.
From 2023 Mallox moved to a RaaS model and stood up a leak site for double extortion. In June 2024 Trend Micro documented a Linux and VMware ESXi variant delivered by a custom shell script that checks for an ESXi environment with administrative rights before encrypting .vmdk, .vmem, .vswp, .vmx, .vmsn and .nvram files with a .locked suffix.
China context: Mallox is one of the most frequently encountered families in Chinese database ransomware cases, and 360's October 2025 report still places it in the domestic top ten. Many manufacturing, retail and finance systems expose port 1433 directly with an unchanged sa password, which keeps supplying targets. Since 2024 the same-lineage family Weaxor has overtaken Mallox itself in domestic volume.
How to identify it
Extensions: .mallox, .malox, .mallab, .malloxx, .ma1x0, .xollam, .bitenc, .FARGO3 and others; some affiliates use the victim company name, and the Linux/ESXi variant uses .locked. Extensions rotate frequently, so do not identify on suffix alone.
Ransom notes: commonly FILE RECOVERY.txt, HOW TO BACK FILES.txt or RECOVERY INFORMATION.txt, directing the victim to a Tor negotiation portal with a victim ID and giving an anonymous mailbox as a fallback.
Intrusion artefacts (the most valuable evidence): many failed sa logons in the MS SQL Server error log followed by one success; xp_cmdshell enabled or system commands run through CLR/OLE components; sqlservr.exe spawning PowerShell or unusual executables; database processes and services forcibly terminated; and traces of staging payloads such as PureCrypter or Remcos RAT. If .mdf/.ldf files are encrypted, the database will not start and port 1433 is exposed, Mallox and its relative Weaxor are the primary suspects.
Infection vectors
Brute-forced MS SQL Server credentials are the signature Mallox entry point. The chain is consistent: scan the internet for instances with port 1433 open; run dictionary attacks against sa and other privileged accounts, with vendors observing success within an hour of the scan starting; enable xp_cmdshell or abuse CLR/OLE components to run a stager; escalate privileges, disable security products, delete shadow copies and stop database services; then encrypt data and backup files and drop the notes.
Other entry points include publicly known web and middleware vulnerabilities, weak RDP credentials, and phishing loaders. The Linux/ESXi variant is normally deployed via a custom shell script once hypervisor administrative access is already held.
A typical Chinese scenario: one Windows server running both the application and the database, with 1433 and 3389 mapped to the internet, an sa password left at its default, and backups on another partition of the same machine. Once scanned, the time from brute force to completed encryption is usually under a day.
Encryption behavior
Mallox encrypts file contents with a symmetric cipher (ChaCha20 or AES variants depending on the build) and protects keys asymmetrically. Early builds had a flawed key-management implementation, which is what allowed Avast to publish a decryptor; the operators fixed it around March 2024 and that path closed.
The database-related behaviour matters most: it terminates SQL Server, MySQL, Oracle, mail and backup-agent services so locked .mdf, .ldf, .dbf, .bak and .trn files can be encrypted; it explicitly targets database and backup files, which is why many victims find their local backup encrypted alongside the database; it deletes volume shadow copies; and it uses partial/intermittent encryption on large files for speed — decisive for later repair work.
Linux / ESXi variant: checks for an ESXi environment and sufficient privileges, then encrypts .vmdk, .vmem, .vswp, .vmx, .vmsn and .nvram files with a .locked suffix.
Assess before you act
Recoverability assessment
Whether Mallox decryption is possible depends first on when encryption happened, and only secondarily on the extension.
1. The Avast free decryptor (2023 to early 2024 only) If files were encrypted between 2023 and early 2024 with one of .bitenc, .ma1x0, .mallab, .malox, .mallox, .malloxx or .xollam, try Avast's Mallox decryptor. The operators fixed the underlying flaw around March 2024, so later builds are out of scope. Trial-decrypt on read-only copies and confirm the output is usable before bulk processing.
2. Backups, snapshots and shadow copies Common survivors include standalone backup servers with no mapped shares, offline media, NAS-side snapshots, versioned cloud object storage with object lock, and off-site DR copies. In database cases, check for log shipping or Always On secondaries.
3. Structure-level repair of database files (the decisive path) Because large files are only partially encrypted, .mdf/.ldf, .dbf and .ibd files usually retain many intact data pages. Depending on how encryption was applied, page-level damage mapping, structural repair and table-level extraction are feasible, with logs and upstream documents replayed to close the delta. Coverage is measured per database and per table: damage on system tables or allocation pages matters far more than damage in historical tables.
4. Virtual disks and unencrypted copies Where the Linux/ESXi variant encrypted .vmdk images, substantial intact regions remain, so repairing the disk and extracting guest data is viable. Downstream warehouses, report exports and read-only replicas often hold usable data too.
We do not pay ransoms, do not negotiate for clients, and never promise that every file can be decrypted or restored.
Our response plan
Hit by Mallox ransomware? What to do
Step 1: Containment and evidence preservation
Immediately remove public exposure of port 1433 (and 3306, 1521 and similar), cut external access from affected servers, and disable sa and any other brute-forced privileged accounts. If the database service was killed, do not repeatedly try to start the database — repeated start attempts can further damage file structures.
Forensic priorities: SQL Server error logs and logon auditing (to establish when brute-forcing began and when it succeeded), records of xp_cmdshell being enabled, child processes of sqlservr.exe, system and security event logs, firewall and port-mapping configuration, the original ransom notes, encrypted samples and matching unencrypted originals. Also preserve a complete file listing and timestamps for the database directories, which is essential for scoping the encryption. Do not reinstall, do not reformat, and do not attempt repairs on original disks.
Step 2: Family identification and encryption timeline
The crux of a Mallox case is nailing family, build and encryption date together, because the free decryptor only covers builds from 2023 to early 2024.
Work involved: verify extensions and note filenames, inspect marker structures in encrypted file headers and footers, correlate filesystem timestamps to pin the exact encryption window, distinguish Mallox proper from its relative Weaxor (.rox/.weax/.wxx with a RECOVERY INFO.txt note), and determine whether this is the Linux/ESXi variant (.locked, encrypted VM files).
Encryption analysis runs in parallel: whether encryption is partial, the block size and stride, and the distribution of damaged data pages. If the timeline falls within the decryptor's scope, take samples and trial-decrypt immediately.
Step 3: Recoverability assessment and recovery planning
Prioritise around the databases and give each item a path and a coverage estimate:
- Decryption path: for files inside the covered window where trial decryption succeeded, define the scope for bulk execution.
- Backup path: verify availability and recovery points for standalone backup servers, offline media, NAS snapshots, cloud version history, and log-shipping or Always On secondaries.
- Repair path: sample .mdf/.ldf, .dbf, .ibd and .vmdk files to map page- and block-level damage, producing per-table and per-VM coverage estimates.
- Replay path: determine the time range that transaction logs, archive logs, upstream systems and paper documents can reconstruct.
- Confirmed unrecoverable: listed explicitly so the business can plan re-entry.
The plan specifies the delivery sequence — usually core operational databases and live transaction tables first, historical data afterwards — and the verification method for each batch.
Step 4: Recovery execution
All work is performed on read-only images and copies. Key activities:
- Database repair: for SQL Server, map page-level damage, repair system tables and allocation structures, then extract data table by table; for Oracle, combine datafile header repair with archive-log application; for MySQL, process .ibd tablespaces individually and rebuild the dictionary.
- Delta reconstruction: replay unaffected transaction logs, archive logs, upstream transaction feeds and business documents to push the recovery point as close to the encryption moment as possible.
- Virtualization: repair .vmdk structures and extract guest data, or rebuild VMs and load data back.
- Files and backups: restore usable backups, and assess whether encrypted .bak files are worth repairing too.
Every batch is reconciled: table-level record counts checked against the business system, key documents sampled and verified, application connectivity and functionality tested. The recovery environment remains isolated from production until residual payloads and backdoors are ruled out.
Step 5: Attribution, hardening and sign-off
Reconstruct the full chain: brute-force source and timing, which account succeeded, the command-execution mechanism (xp_cmdshell, CLR or OLE), staging payloads, privilege escalation and lateral paths, when shadow copies were deleted, and whether data was exfiltrated — Mallox is a double-extortion family and that finding drives regulatory notification.
Hardening becomes a verifiable checklist: no public exposure of database ports, with 1433/3306/1521 mappings removed; strong passwords and source-IP restrictions on sa, root and other privileged accounts; dangerous extensions such as xp_cmdshell disabled and the database service running under a low-privilege account; database hosts segmented from the general business network; backups moved to offline/off-site plus immutable storage, with database backups physically separated from data files; database auditing and failed-logon alerting added; EDR extended to cover database hosts. The engagement closes with an incident report, a hardening sign-off checklist and monitoring recommendations.
Risk warning
What not to do
- Do not repeatedly try to start the encrypted database instance, and do not run DBCC repair or attach operations against .mdf/.ldf files — those writes destroy the original structures repair depends on.
- Do not attempt recovery on original disks. Image the volumes holding the database files read-only and perform all decryption and repair on copies.
- Do not judge decryptability from the extension alone. The Avast decryptor only covers builds from 2023 to early 2024, so the encryption date matters more than the suffix.
- Do not delete ransom notes, encrypted samples or SQL Server error logs — the logs are the core evidence for the brute-force entry point and the encryption timeline.
- Do not bring services back before connectivity is remediated; with 1433 still exposed and the sa password unchanged, re-encryption is close to certain.
- Do not pay or negotiate through the portal yourself. Mallox is a double-extortion family: payment guarantees neither a working decryptor nor suppression of stolen data.
Emergency response
Data already encrypted? Stop and let an engineer look first
We do not pay ransoms and we do not negotiate with attackers. Engineers run a free assessment first, then propose a recovery plan and a firm quote.
Related scenarios
SQL Server Database Encrypted by Ransomware
When SQL Server .mdf / .ldf files are encrypted, the ERP and inventory systems built on them — Yonyou U8, Kingdee K/3, Guanjiapo, Suda — stop completely. This page covers evidence handling, how we judge whether page-level repair is viable, and the conditions for backup-plus-log restore.
Database Encrypted by Ransomware
When database files are encrypted, every business system that depends on them stops at once. This page explains how we triage an encrypted database, how recoverability is assessed, and when file repair, backup-plus-log restore, or rebuild is the right path.
ESXi / Hyper-V Virtualization Encrypted by Ransomware
Hypervisor-level encryption causes the widest blast radius of any ransomware event: dozens of production VMs go dark within an hour or two. This page covers what Linux ESXi encryptors actually do — shut down guests, encrypt vmdk, delete snapshots — the recovery value of flat disk files, and how Hyper-V and Proxmox cases differ.
Backups Deleted or Destroyed
Modern ransomware follows a fixed sequence: destroy the backups, then encrypt the data — deleting shadow copies, encrypting repositories, disabling jobs, and exploiting backup software flaws to steal credentials. This page covers what can still be inventoried once backups fail, why replication propagates encrypted files off-site, and what offline and immutable copies are really worth.
Related industries
Manufacturing Ransomware Response and Recovery
Ransomware in manufacturing hits information systems and production cadence at the same time: with ERP down there are no orders, with MES down there is no schedule, and an encrypted drawing library takes the process documentation for an entire product line with it. This page covers the asset profile, recovery priorities and targeted defences.
Retail and E-commerce Ransomware Response
In retail and e-commerce, ransomware translates directly into an inability to sell: order systems, membership, POS and warehouse fulfilment stop together and losses accrue by the hour. This page covers the sector's attack patterns, a recovery order built around the order-to-fulfilment chain, and handling of member data exposure.
Financial Services Ransomware Response and Recovery
Financial and quasi-financial institutions face far stricter requirements on data integrity, transaction continuity and regulatory reporting than most sectors, so one ransomware event hits availability, customer trust and compliance simultaneously. This page covers the threat profile, a recovery approach centred on transactional consistency, and hardening priorities.
Similar families
- No public decryptor
Weaxor
Weaxor emerged in late 2024 as a same-lineage successor to Mallox, continuing its focus on MS SQL Server and exposed web services. It appends .rox, .weax or .wxx and drops a RECOVERY INFO.txt note. It has led infection volume in China through 2025 and 2026 (45.45% in July 2026, 65.74% in August 2026) and has no public decryptor.
- No public decryptor
TellYouThePass
TellYouThePass is the archetypal vulnerability-driven ransomware family in China, mass-deployed against internet-facing ERP, OA, finance and middleware systems. It appends .locked and hits both Windows and Linux servers. No public decryptor exists.
- Some versions decryptable
LockBit
LockBit is one of the largest ransomware-as-a-service operations in the world. Despite the 2024 law-enforcement takedown it returned as LockBit 5.0, with working Windows, Linux and VMware ESXi payloads, and it remains one of the most frequently seen families in China.
Related questions
- First response
What should I do if I've been hit by ransomware?
Isolate first and keep the power on: unplug the network cable or turn off Wi-Fi, but do not reboot, format, delete the ransom note or contact the attackers. Then work in order: confirm it is ransomware and whether it is still spreading, preserve the note, encrypted samples and logs, identify the family, inventory backups and snapshots to assess recovery paths, and report the incident. Do not reconnect restored systems until the entry point is closed, credentials are rotated and backdoors are removed.
- Recovery
Can files encrypted by ransomware be recovered?
Often in part, sometimes almost entirely, but nobody can promise it before seeing samples. Recoverability comes down to four things: the family and version (is there a public decryptor, seized keys or a known flaw), how the files were encrypted (in full, or only partly), which backups, snapshots and other copies survived, and what has been written to the disks since. Where a modern family encrypted files correctly and completely, no copies survive and the remnants have been overwritten, the data may genuinely be gone. Stop all writes and identify the family first.
- First response
What should we do when a server is hit by ransomware?
Isolate first and do not reboot: cut the affected server off at the switch or in the cloud security group, but leave it running. Then snapshot or image the system and data disks, keep the ransom note and encrypted samples, and check read-only whether shadow copies, cloud snapshots and backups survived. If several servers are down, set a restore order by business dependency, and bring nothing back online until the entry point is closed and every credential has been changed. What can be recovered depends on the family, the encryption mode and the backups.
- Recovery
Which ransomware decryption tools exist, and are downloaded ones safe to use?
Yes, but not many. Legitimate free decryptors come from the No More Ransom project, law enforcement agencies and the official channels of vendors such as Emsisoft, Avast, Kaspersky, Bitdefender and 360, and each usually works only for specific versions of a specific family. Programs circulating online as universal or dedicated decryptors are often malware or paid scams. Even with a genuine tool, confirm the family and version match first, and run it only on copies of your files.
- Systems & software
What should we do when Guanjiapo or Suda account sets are encrypted by ransomware?
Isolate the server holding the account sets from the network but keep it powered on. Do not reinstall the accounting software, restore an account set over the original disk, or run decryptors from the internet. Guanjiapo, Suda, Chanjet T+ and T3, Kingdee KIS Professional and similar products mostly keep account sets in SQL Server, with built-in automatic backups on the same machine, so both tend to be encrypted together. How much comes back depends on the family and how it encrypted, whether a clean backup exists beyond that server, and whether the database files were only partly encrypted. After recovery, reconcile stock, receivables and payables line by line, and close the entry point before going back online.
FAQ
Mallox Frequently asked questions
Can Mallox be decrypted? Does the free decryptor apply to us?
It depends on when encryption happened. Avast's free Mallox decryptor only works on files encrypted between 2023 and early 2024, covering extensions such as .bitenc, .ma1x0, .mallab, .malox, .mallox, .malloxx and .xollam. The operators fixed the exploited cryptographic flaw around March 2024, and later builds cannot be decrypted with it.
How to check: establish the encryption window from filesystem timestamps and the ransom-note drop time, then trial-decrypt samples of varying sizes on read-only copies — success means the output opens correctly in the business application. If encryption occurred after March 2024, invest the time in backup inventory and structure-level repair of the database files rather than hunting for a decryptor.
Mallox encrypted our SQL Server .mdf file — can the database be recovered?
There is room to recover, but assess in order. Backups first: a standalone backup server, offline media, off-site DR, or a log-shipping/Always On secondary — any of these is more reliable than repair.
If there genuinely is no backup, go to structure-level repair. Mallox encrypts large files only partially, and production .mdf files are usually far larger than the encrypted portion, so many intact data pages remain. Depending on how encryption was applied, it is feasible to map page-level damage, repair system tables and allocation structures, extract data table by table, and then advance the recovery point using an undamaged .ldf transaction log plus upstream transaction feeds.
To be explicit: this is repair, not decryption. Coverage depends on which objects the damaged pages belong to and can only be estimated after sampling. We do not promise "100% recovery".
We were breached via port 1433 — why was encryption so fast?
Because the Mallox chain is almost fully automated. Operators mass-scan the internet for port 1433 and dictionary-attack the sa account; honeypot observations by several vendors recorded successful logon within an hour of the attack starting. A successful logon already grants high privilege, after which xp_cmdshell or CLR/OLE components execute system commands to download the payload, disable security products, delete shadow copies, stop database services and encrypt.
No elaborate lateral movement is required, because the database host is itself the most valuable target and many organisations run the application, the database and the backups on the same server. There is only one root fix: keep database ports off the internet, route remote access through a VPN with enforced multi-factor authentication, and eliminate weak sa credentials.
Should we pay the Mallox ransom?
We do not pay ransoms and do not negotiate for clients, and we advise against paying independently. Mallox has used double extortion since 2023: payment guarantees neither a working decryptor nor that stolen data stays off the leak site, and sending funds to an overseas criminal operation carries compliance and legal exposure.
The pragmatic use of the first 24 to 72 hours is threefold: complete isolation and forensics so there is no second encryption wave; inventory every potentially surviving backup and snapshot, including standalone backup servers, NAS snapshots, cloud version history and database secondaries; and run sample-based repair feasibility tests on the database files. In most Mallox cases the combined coverage of backups, structural repair and log replay is far more controllable than betting on a decryptor.
Are Mallox and Weaxor the same family?
Not the same name, but public research broadly treats Weaxor as a rebrand or same-lineage successor to Mallox from late 2024: MS SQL Server remains the core target and the delivery and obfuscation techniques carry over from Mallox, while extensions changed to .rox, .weax and .wxx and the note became RECOVERY INFO.txt. 360's 2025 domestic reports show Weaxor far exceeding Mallox in infection volume, ranking first nationally in several months.
The operational implication is direct: Avast's Mallox decryptor does not apply to Weaxor, and Weaxor currently has no public decryption tool. So when you see .rox or .weax, do not hunt for a Mallox decryptor — go straight to backup inventory and database repair assessment. Accurate family identification saves valuable time here.
Sources
- Unit 42 (Palo Alto Networks): Threat Group Assessment: Mallox Ransomware
- Gen Digital / Avast: Decrypted: Mallox ransomware
- Trend Micro: TargetCompany's Linux Variant Targets ESXi Environments
- Kaspersky Securelist: Evolution of Mallox – from private ransomware to RaaS
- AhnLab ASEC: Analysis of TargetCompany's Attacks Against MS-SQL Servers
External links are provided for reference only. The content is published by third parties and does not represent our position.
Updated