Mallox ransomware (virus) - Free Guide

What is Mallox ransomware?

Mallox ransomware blocks access to all personal files and then demands the payment for reverting the process

Ransomware can be stopped by security software before it manages to encrypt files

Ransomware is a type of malware that is used for money extortion thanks to its ability to encrypt all personal files on the targeted Windows machine. In the past decade, it has been one of the most prevalent and lucrative illegal businesses in the cybercrime scene. Attackers increasingly target medium to large organizations and businesses, which was enforced even further by a coronavirus pandemic. Likewise, new strains that focus on home users appear almost daily.

Mallox ransomware showed up in late October 2021, with its main target being personal Windows computers, meaning that the operations are on the lower scale, at least for now. Just like any other malware of this type, it gains access to users' computers in stealthy ways and begins changing the system immediately.

Soon after the infection begins, the ransomware then applies a sophisticated encryption algorithm^[1] to lock all documents, databases, pictures, and other personal files on the device, appending .mallox extension in the process. When it comes to data encryption, there are two aspects that should be noted:

• Files are not damaged or corrupted but locked under a complex password
• The virus does not touch certain directories or files, mainly executables, and everything that is needed by Windows to boot and run.

As soon as the data-locking process is finished, the malware then delivers the ransom note – a text file titled “RECOVERY INFORMATION.txt.” In the note, the attackers claim that the only way to restore files is to pay for a decryptor and recommend users contact them via mallox.israel@mailfence.com or mallox@tutanota.com emails.

We strongly advise you not to pay the ransom, as there is no guarantee you retrieve access to your files. Instead, check all the information below, as we provide alternative methods that could help you recover at least some of your data without paying and risking losing your money.

The ransom note analysis

A ransom note is one of the main components of a ransomware scheme. It informs users about what happened to their files and what they can do to retrieve them. Almost all file-locking malware authors use a ransom note to communicate with their victims. Otherwise, the payment simply can't be made, and it serves as a loss for hackers. The Mallox virus delivers the following message:

YOUR FILES ARE ENCRYPTED !!!

TO DECRYPT, FOLLOW THE INSTRUCTIONS:

To recover data you need decrypt tool.

To get the decrypt tool you should:

1.In the letter include your personal ID! Send me this ID in your first email to me!
2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files!
3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool!
4.We can decrypt few files in quality the evidence that we have the decoder.

CONTACT US:
mallox.israel@mailfence.com
mallox@tutanota.com

YOUR PERSONAL ID:

The note does not differ much from other malware strains, such as Rivd or CryptoJoker 2021. It is typical for the attackers to offer an allegedly free test decryption service, which is meant to prove that the decryption is possible. In other words, crooks are trying to gain users' trust, increasing the chances of them paying the ransom.

Ransomware authors provide a ransom note to ensure that victims contact them via the provided emails

However, keep in mind that ransomware authors are not your friends, and they don't really care for you or your files (they illegally encrypted your data in the first place!). Therefore, you should dismiss all the requests to contact them and instead use the alternative solutions we provide below. You should start with Mallox virus removal and only then proceed with data recovery options.

Using security software to remove Mallox ransomware

Ransomware is among the most devastating computer infections, be it for home users or corporations. Not only can they hold files hostage, but they also compromise the security of the infected machine. Likewise, cybercriminals might employ additional modules to secretly steal personal data in the background as long as the malware is running.

One of the common traits of ransomware is that it often self-deletes after the job of file encryption is complete. Thus, even if you might not find ransomware infection, there could be plenty of malicious files, modules, processes, components, or even other malware running in the background. For that reason, you should always start with a computer scan with SpyHunter 5Combo Cleaner or Malwarebytes security software.

Before you proceed, it is important to note that malware can spread to other computers connected to the same network or LAN, so it is vital to immediately disconnect the infected PC from the internet. You can simply pull out the Ethernet cable or disconnect from WiFi by right-clicking the internet icon in the taskbar. Only then proceed with the virus elimination. If your security software is being blocked in normal mode, access Safe Mode as explained below.

Windows 7 / Vista / XP

1. Click Start > Shutdown > Restart > OK.
2. When your computer becomes active, start pressing the F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
3. Select Safe Mode with Networking from the list.

Windows 10 / Windows 8

1. Right-click on the Start button and select Settings.
   
2. Scroll down to pick Update & Security.
3. On the left side of the window, pick Recovery.
4. Now scroll down to find the Advanced Startup section.
5. Click Restart now.
6. Select Troubleshoot.
7. Go to Advanced options.
8. Select Startup Settings.
9. Click Restart.
10. Press 5 or click 5) Enable Safe Mode with Networking.

Note that all sorts of computer problems might arise after the virus is eliminated. Since new ransomware is commonly riddled with bugs or other issues, it might damage or even destroy certain Windows components and settings. As a result, you might experience crashes, failure to load files/programs, BSODs, errors, and other issues.

To avoid reinstalling the whole operating system, we strongly recommend employing PC repair software FortectIntego. It can replace the damaged system files with brand new ones with the help of its unique reconstruction capabilities without having to reinstall the OS. Likewise, the app can also help you clean the system from useless files, protect your privacy, and get rid of the most common Windows problems that arise due to other reasons.

Making encrypted file backups

Companies and businesses have procedures for keeping file backups, hence this feature of ransomware is relatively harmless to those entities (although cybercriminals are now stealing classified company information before deploying the ransomware).^[2] Unfortunately, regular computer users, especially those who get infected with ransomware for the very first time, rarely have file backups available.

Therefore, before you proceed with the next step, you should make backups of your encrypted files. Simply insert a USB stick or other storage device and copy the field over. You can also use cloud storage such as OneDrive or Google Drive. You can find detailed instructions on how to do this at the very bottom of this post. Note that this step is necessary in order to avoid file corruption when attempting to restore them using the methods provided in the next section.

File recovery process

There is a lot of misunderstanding about how ransomware works from those affected. Most users who get infected with ransomware actually have never even heard of it before. Those who do, usually know very little about it as well, although file encryption is a very distinct feature of this malware type.

Some users believe that their files have been damaged in some kind of way, mainly because they can no longer be opened, and they are also stripped of their normal icons. However, this is not true, at least in most cases. A sophisticated encryption algorithm uses a randomly-generated alphanumeric key that is used to lock every personal file on the system. Cybercriminals hold that key and obviously aren't willing to provide it for free.

In other cases, people believe that their files will turn back to normal as soon as they perform a full system scan with anti-malware software. This is also not correct, as security software is simply not designed for that. Although, it is important to point out that anti-malware should always be used to remove the infection from the system regardless.

With all that being said, if you have no working file backups you created before, the chances of restoring the encrypted data successfully are rather slim. Nonetheless, we strongly advise following these steps instead of doing business with cybercriminals. If you do, you risk losing your money in addition to files, so be warned.

1. Use data recovery software

• Download Data Recovery Pro.
• Double-click the installer to launch it.
  
• Follow on-screen instructions to install the software.
• As soon as you press Finish, you can use the app.
• Select Everything or pick individual folders where you want the files to be recovered from.
• Press Next.
• At the bottom, enable Deep scan and pick which Disks you want to be scanned.
• Press Scan and wait till it is complete.
• You can now pick which folders/files to recover – don't forget you also have the option to search by the file name!
• Press Recover to retrieve your files.

2. Wait for a decryption tool

Mallox is a new ransomware strain, which means that there is no free decryption tool for the public available. However, cybercriminals who are new in the scene commonly make mistakes when building ransomware, and security experts can make use of this flaw, creating a free decryptor. In other cases, cybercriminals' servers might be captured by the law authorities^[3] and the keys released. Follow these links and look for a decryption tool:

• No More Ransom Project
• Free Ransomware Decryptors by Kaspersky
• Free Ransomware Decryption Tools from Emsisoft
• Avast decryptors

To protect yourself from further infections of ransomware, always keep your files on backups, and never ignore the warnings of your security software, which should be running in the background at all times. Below you will also find instructions on how to report the incident to the authorities.