Analysis of Ransomware With BAT File Extension Attacking MS-SQL Servers (Mallox)

AhnLab Security Emergency response Center (ASEC) has recently discovered the Mallox ransomware with the BAT file extension being distributed to poorly managed MS-SQL servers. Extensions of files distributed to poorly managed MS-SQL servers include not only EXE but also BAT, which is a fileless format. The files distributed with the BAT file extension that has been discovered so far are Remcos RAT and Mallox.

The distributions include cases that use PowerShell and sqlps. The sqlps distribution was covered on the …

ahnlab analysis asec bat bat file center distributed emergency extension extensions file fileless files mallox ransomware malware analysis managed ms-sql ransomware response security servers sql sql servers