信息安全与通信保密

以勒索病毒家族中一个常见变种Mallox勒索病毒为研究对象，通过在隔离网络的虚拟机中进行反复实验，归纳出该病毒在运行环境、执行过程、破坏结果 3个方面的特征，揭示了其鲜为人知的细节特征。总结该病毒被捕获的过程，提出了“封地址、禁下载、勤更新、多备份”的勒索病毒防护策略，并阐述了防御勒索病毒的实用方法。经长时间实战检验，该方法行之有效，旨在通过总结勒索病毒样本实验过程和结果，提升对Mallox勒索病毒的认知，为勒索病毒防护提供参考。

This paper takes Mallox ransomware, a prevalent variant of the global ransomware family, as the research subject. Through repeated experiments in virtual machines deployed on an isolated network, it summarizes the characteristics of the ransomware across three core dimensions: runtime environment, execution workflow, and damage impact, and identify previously unreported detailed features of this malware sample. This paper summarizes the capture process of the ransomware, puts forward the ransomware protection strategy of "Block malicious addresses, Restrict unauthorized downloads, Perform regular updates, and Maintain multi-copy backups", and expounds practical methods for ransomware defense. Verified by long-term practical application, the above methods are effective. This paper aims to deepen the academic understanding of Mallox ransomware by summarizing the experimental process and results of ransomware samples, and provide references for global ransomware prevention and control.