恶意文件名称：
Mallox
威胁类型：
简单描述：
Mallox勒索病毒首次出现于2021年10月，采用RaaS（勒索软件即服务）模式运营，将企业作为其攻击目标，利用产品漏洞阶段性实施大范围攻击。此次新变种于2024年10月底开始出现，其加密后缀包括 .weaxor、.wxx、.wxr、.rox 等。目前，【深信服统一端点安全管理系统aES】已支持查杀拦截此病毒。
事件分析
攻击溯源分析
近期，深信服应急响应团队和深盾终端安全实验室接到多起Mallox攻击溯源请求，通过整合终端安全软件日志、用户行为日志、进程监控数据等多种日志源，结合该勒索软件家族的攻击特征及情报信息，利用AI技术进行综合分析，最终构建攻击者行为特征画像和受害者影响范围画像。
恶意文件分析
该恶意软件首先会调用GetUserDefaultLanguageID检查当前计算机的语言设置，并在特定语言环境（如俄语、哈萨克语、白俄罗斯语、乌克兰语和鞑靼语）下直接退出程序，从而避免加密这五种语言环境下的文件。
通过加载 PowrProf.dll 库并调用 PowerSetActiveScheme 函数，Mallox将系统的电源模式设置为高性能，以提高系统性能和响应速度。
IOCs
|
0ca38cddd100f677a208414bef656ae0 |
Mallox MD5 |
|
4c74caa9c0eeb2c7637da9bbde9535d7 |
Mallox MD5 |
|
7286f8e0a7c344462186f35d46b6ae71 |
Mallox MD5 |
|
a087e994db776a0c657e45d315851186 |
Mallox MD5 |
|
a74ee50d2f91f77f010ecb154aa6b30b |
Mallox MD5 |
|
http[:]//193.143.1.139/Ujdu8jjooue/biweax.php |
C&C |
|
.386,.adv,.ani,.bat,.bin,.cab,.cmd,.com,.cp,.cur,.deskthemepack,.diagcfg,.diagpkg,.diangcab,.drv,.hlp,.hta,.ic,.icns,.ico,.ics,.idx,.key,.lock,.mod,.mpa,.msc,.msi,.msp,.msstyles,.msu,.nls,.nomedia,.ocx,.prf,.rom,.rox,.rtp,.scr,.shs,.sp,.sys,.theme,.themepack,.wex,.wpx |
避免加密的文件后缀 |
|
Anydesk.exe,Anydesk.msi,AnyDeskMSI.exe,autorun.inf,boot.ini,bootfont.bin,bootsect.bak,debugLog.txt,desktop.ini,iconcache.db,ntldr,ntuser.dat,ntuser.dat.log,ntuser.ini,stepdata.txt,thumbs.db,wex.txt,windows.old,wxr.txt |
避免加密的文件名 |
|
$windows.~bt,$windows.~ws,appdata,application data,Assemblies,boot,Common Files,Core Runtime,google,intel,Internet Explorer,Microsoft Analysis Services,Microsoft ASP.NET,Microsoft Help Viewer,Microsoft MPI,Microsoft Security Client,Microsoft.NET,mozilla,msocache,Package,Package Store,perflogs,programdata,Reference,Store,system volume information,tor browser,Windows,Windows Defender,Windows Kits,Windows Mail,Windows Microsoft.NET,Windows NT,Windows Photo Viewer,Windows Portable Devices,Windows Sidebar,windows.old,WindowsPowerShell |
避免加密的文件目录 |
|
Application,HardwareEvents,Internet Explorer,Key Management Service,Microsoft-WindowsPhone-Connectivity-WiFiConnSvc-Channel,Microsoft-WindowsPhone-LocationServiceProvider/Debug,Microsoft-WindowsPhone-Net-Cellcore-CellManager/Debug,Microsoft-WindowsPhone-Net-Cellcore-CellularAPI/Debug,Microsoft-Windows-TunnelDriver,Microsoft-Windows-UserPnp/Performance,Microsoft-Windows-UserPnp/SchedulerOperations,Microsoft-Windows-UserSettingsBackup-BackupUnitProcessor/Operational,Microsoft-Windows-UserSettingsBackup-Orchestrator/Operational,Microsoft-Windows-UxInit/Diagnostic,Microsoft-Windows-UxTheme/Diagnostic,Microsoft-Windows-VAN/Diagnostic,Microsoft-Windows-VDRVROOT/Operational,Microsoft-Windows-VerifyHardwareSecurity/Admin,Microsoft-Windows-VerifyHardwareSecurity/Operational,Microsoft-Windows-VHDMP-Analytic,Microsoft-Windows-VHDMP-Operational,Microsoft-Windows-VIRTDISK-Analytic,Microsoft-Windows-Volume/Diagnostic,Microsoft-Windows-VolumeControl/Performance,Microsoft-Windows-VolumeSnapshot-Driver/Analytic,Microsoft-Windows-VolumeSnapshot-Driver/Operational,Microsoft-Windows-VPN/Operational,Microsoft-Windows-VPN-Client/Operational,Microsoft-Windows-VWiFi/Diagnostic,Microsoft-Windows-WABSyncProvider/Analytic,Microsoft-Windows-Wcmsvc/Diagnostic,Microsoft-Windows-Wcmsvc/Operational,Microsoft-Windows-WCN-Config-Registrar/Diagnostic,Microsoft-Windows-WCNWiz/Analytic,Microsoft-Windows-WDAG-PolicyEvaluator-CSP/Operational,Microsoft-Windows-WDAG-PolicyEvaluator-GP/Operational,Microsoft-Windows-WebAuth/Operational,Microsoft-Windows-WebAuthN/Operational,Microsoft-Windows-WebcamProvider/Analytic,Microsoft-Windows-WebIO/Diagnostic,Microsoft-Windows-WebIO-NDF/Diagnostic,Microsoft-Windows-WebPlatStorage-Server,Microsoft-Windows-WebServices/Tracing,Microsoft-Windows-Websocket-Protocol-Component/Tracing,Microsoft-Windows-WEPHOSTSVC/Operational,Microsoft-Windows-WER-PayloadHealth/Operational,Microsoft-Windows-WFP/Analytic,Microsoft-Windows-WFP/Operational,Microsoft-Windows-WiFiDisplay/Analytic,Microsoft-Windows-Win32k/Concurrency,Microsoft-Windows-Win32k/Contention,Microsoft-Windows-Win32k/Messages,Microsoft-Windows-Win32k/Operational,Microsoft-Windows-Win32k/Power,Microsoft-Windows-Win32k/Render,Microsoft-Windows-Win32k/Tracing,Microsoft-Windows-Win32k/UIPI,Microsoft-Windows-Windeploy/Analytic ,Microsoft-Windows-Windows Defender/Operational,Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurity,Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurityVerbose,Microsoft-Windows-Windows Firewall With Advanced Security/Firewall,Microsoft-Windows-Windows Firewall With Advanced Security/FirewallDiagnostic,Microsoft-Windows-Windows Firewall With Advanced Security/FirewallVerbose,Microsoft-Windows-WindowsBackup/ActionCenter,Microsoft-Windows-WindowsColorSystem/Debug,Microsoft-Windows-WindowsColorSystem/Operational,Microsoft-Windows-WindowsSystemAssessmentTool/Operational,Microsoft-Windows-WindowsSystemAssessmentTool/Tracing¬dXqZJ0,Microsoft-Windows-WindowsUIImmersive/Diagnostic,Microsoft-Windows-WindowsUIImmersive/Operational,Microsoft-Windows-WindowsUpdateClient/Analytic,Microsoft-Windows-WindowsUpdateClient/Operational,Microsoft-Windows-WinHttp/Diagnostic,Microsoft-Windows-WinHttp/Operational,Microsoft-Windows-WinHTTP-NDF/Diagnostic,Microsoft-Windows-WinHttp-Pca,Microsoft-Windows-WinINet/Analytic,Microsoft-Windows-WinINet/Operational,Microsoft-Windows-WinINet/Pca,Microsoft-Windows-WinINet/UsageLog,Microsoft-Windows-WinINet/WebSocket,Microsoft-Windows-WinINet-Capture/Analytic,Microsoft-Windows-WinINet-Config/ProxyConfigChanged,Microsoft-Windows-Wininit/Diagnostic,Microsoft-Windows-Winlogon/Diagnostic,Microsoft-Windows-Winlogon/Operational,Microsoft-Windows-WinMDE/MDE,Microsoft-Windows-WinML/Analytic,Microsoft-Windows-WinNat/Oper,Microsoft-Windows-WinNat/Trace dX}WJ0,Microsoft-Windows-WinRM/Analytic,Microsoft-Windows-WinRM/Debug,Microsoft-Windows-WinRM/Operational,Microsoft-Windows-Winsock-AFD/Operational,Microsoft-Windows-Winsock-NameResolution/Operational,Microsoft-Windows-Winsock-WS2HELP/Operational,Microsoft-Windows-Winsrv/Analytic,Microsoft-Windows-WinURLMon/Analytic,Microsoft-Windows-Wired-AutoConfig/Diagnostic,Microsoft-Windows-Wired-AutoConfig/Operational,Microsoft-Windows-WLAN-Autoconfig/Diagnostic,Microsoft-Windows-WLAN-AutoConfig/Operational,Microsoft-Windows-WLANConnectionFlow/Diagnostic,Microsoft-Windows-WlanDlg/Analytic,Microsoft-Windows-WLAN-Driver/Analytic,Microsoft-Windows-WLAN-MediaManager/Diagnostic,Microsoft-Windows-wmbclass/Analytic,Microsoft-Windows-wmbclass/Trace,Microsoft-Windows-WMI-Activity/Debug,Microsoft-Windows-WMI-Activity/Operational,Microsoft-Windows-WMI-Activity/Trace,Microsoft-Windows-WMPDMCUI/Diagnostic,Microsoft-Windows-WMPNSS-PublicAPI/Diagnostic,Microsoft-Windows-WMPNSS-Service/Diagnostic,Microsoft-Windows-WMPNSS-Service/Operational,Microsoft-Windows-WMPNSSUI/DiagnosticNavigator,Microsoft-Windows-Wordpad/Admin,Microsoft-Windows-Wordpad/Debug,Microsoft-Windows-Wordpad/Diagnostic,Microsoft-Windows-WorkFolders/Analytic,Microsoft-Windows-WorkFolders/Debug,Microsoft-Windows-WorkFolders/Operational,Microsoft-Windows-WorkFolders/WHC,Microsoft-Windows-Workplace Join/Admin,Microsoft-Windows-WPD-API/Analytic,Microsoft-Windows-WPD-ClassInstaller/Analytic,Microsoft-Windows-WPD-ClassInstaller/Operational,Microsoft-Windows-WPD-CompositeClassDriver/Analytic,Microsoft-Windows-WPD-CompositeClassDriver/Operational,Microsoft-Windows-WPD-MTPBT/Analytic,Microsoft-Windows-WPD-MTPClassDriver/Analytic,Microsoft-Windows-WPD-MTPClassDriver/Operational,Microsoft-Windows-WPD-MTPIP/Analytic,Microsoft-Windows-WPD-MTPUS/Analytic,Microsoft-Windows-WSC-SRV/Diagnostic,Microsoft-Windows-WUSA/Debug,Microsoft-Windows-WWAN-CFE/Diagnostic ,Microsoft-Windows-WWAN-MediaManager/Diagnostic,Microsoft-Windows-WWAN-MM-Events/Diagnostic,Microsoft-Windows-WWAN-NDISUIO-EVENTS/Diagnostic,Microsoft-Windows-WWAN-SVC-Events/Diagnostic,Microsoft-Windows-WWAN-SVC-Events/OperationalOfficeChannel,Microsoft-Windows-XAML/Default,Microsoft-Windows-XAML-Diagnostics/Default,Microsoft-Windows-XAudio2/Debug,Microsoft-Windows-XAudio2/Performance,Network Isolation Operational,NIS-Driver-WFP/Diagnostic,OAlerts,OfficeDebugChannel,OpenSSH/Admin,OpenSSH/Debug,OpenSSH/Operational,OSK_SoftKeyboard_Channel,Physical_Keyboard_Manager_Channe,Physical_Keyboard_Manager_Channel,PlayReadyPerformanceChannel,RTWorkQueueTheading,Schannel Security Package,Security,Setup,SmbWmiAnalytic,SMSApi,System,SystemEventsBroker,TabletPC_InputPanel_Channel,TabletPC_InputPanel_Channel/IHM,TimeBroker,Uac/Debug,UIManager_Channel,Windows Networking Vpn Plugin Platform/Operational,Windows Networking Vpn Plugin Platform/OperationalVerbose,Windows PowerShell,WINDOWS_KS_CHANNEL,WINDOWS_MFH264Enc_CHANNEL,WINDOWS_MP4SDECD_CHANNEL,WINDOWS_MSMPEG2ADEC_CHANNE,WINDOWS_MSMPEG2VDEC_CHANNEL,WINDOWS_VC1ENC_CHANNEL,WINDOWS_WMPHOTO_CHANNEL,WINDOWS_wmvdecod_CHANNEL,WMPSetup,WMPSyncEngine,WordChannel |
清除的日志 |
解决方案
深信服解决方案
【深信服统一端点安全管理系统aES】已支持查杀拦截此次事件使用的病毒文件，aES全新上线“动静态双AI引擎”，静态AI能够在未知勒索载荷落地阶段进行拦截，动态AI则能够在勒索载荷执行阶段进行防御，通过动静态AI双保险机制可以更好地遏制勒索蔓延。不更新也能防护，但建议更新最新版本，取得更好防护效果。
【深信服安全托管服务MSS】以保障用户网络安全“持续有效”为目标，通过将用户安全设备接入安全运营中心，依托于XDR安全能力平台和MSSP安全服务平台实现有效协同的“人机共智”模式，围绕资产、脆弱性、威胁、事件四个要素为用户提供7*24H的安全运营服务，快速扩展持续有效的安全运营能力，保障可承诺的风险管控效果。
原文始发于微信公众号（深信服千里目安全技术中心）：【勒索防护】Mallox新变种再度来袭，正利用产品漏洞对国内企业实施攻击
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论