Avast Releases Free Decryptor for TargetCompany (Mallox) Ransomware

Avast released a free decryptor for TargetCompany ransomware, also tracked as Mallox, allowing some victims to recover encrypted files without paying. The tool works by cracking the decryption password from a pair of matching encrypted and original files, a CPU-intensive process that can take tens of hours but only needs to be completed once per affected device; interrupted cracking sessions can also be resumed. Researchers said the ransomware has been active since mid-2021, commonly appending extensions including .mallox, .exploit, .architek, and .brg, and dropping the ransom note HOW TO RECOVER !!.TXT in affected folders.

Technical reporting shows the malware prepares systems for encryption by deleting shadow copies, altering boot and recovery settings, assigning privileges, enumerating drives, and terminating processes that could lock valuable data such as databases and backup-related services. Avast said file encryption uses ChaCha20, with key protection involving Curve25519 and AES-128, while later threat intelligence linked Mallox to a more active double-extortion operation that uses a .NET loader, in-memory payload decryption, victim data exfiltration, and a leak site, with some observed process-killing behavior suggesting possible interest in critical infrastructure and operational technology environments.