Mallox Ransomware Being Distributed in Korea

AhnLab Security Emergency response Center (ASEC) has recently discovered the distribution of the Mallox ransomware during the team’s monitoring. As covered before, Mallox, which targets vulnerable MS-SQL servers, has historically been distributed at a consistently high rate based on AhnLab’s statistics.

Figure 1. Ransomware statistics for Q4 2022

The malware disguised as a program related to DirectPlay is a file built in .NET which, as shown in Figure 3, connects to a certain address, downloads additional malware, and runs it …

address ahnlab asec center distributed distribution emergency high korea mallox ransomware malware malware analysis monitoring ms-sql program ransomware rate response security servers sql sql servers statistics team vulnerable