- Home
Detectable Ransomware Tohnichi
Ransomware Research
Tohnichi Ransomware
Tohnichi is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on June 1, 2021, this ransomware has been actively targeting systems worldwide.
Quick Facts
- Ransomware Family
- Tohnichi
- First Seen
- June 1, 2021
How Tohnichi Ransomware Works
Targeted Files
https://unit42.paloaltonetworks.com/mallox-ransomware/ 2952d5889bdb07148770453cb5f01fa6cc4deabf97290cc511b71d6e122cfc48 -> .Net Loader cb9ad9670dcb82aa54a6526d35fee8ed1e63a1abbb29d2db2acb3f5e49b66aac -> .Net Loader 8820fe6c0f2d9f702a91f92a275a534de63e88de46f2baa05d50d4d7855bf319 -> .Net Loader
File Encryption Patterns
Tohnichi modifies encrypted files using specific patterns to mark them as encrypted:
File extensions added after encryption:
..tohnichi
..herrco
..mallox
..brg
..architek
..exploit
..carone
..avast
..consultransom
..devicZz
..acookies
..bozon3
..bozon
..FARGO
..FARGO2
..artiis
Ransom Note and Payment Demands
After encrypting files, Tohnichi displays ransom notes demanding payment for file recovery:
How to decrypt files.txt
Ransom message:
notes/How to decrypt files.txt
Note locations:
EveryFolder
RECOVERY INFORMATION.txt
Ransom message:
notes/RECOVERY INFORMATION.txt
Note locations:
EveryFolder
FILE RECOVERY.txt
Ransom message:
notes/FILE RECOVERY.txt
Note locations:
EveryFolder
Technical Indicators
Associated Executable Files
The following executable files are associated with Tohnichi ransomware:
local.exe
ConsoleApp2.exe
aRX-00-23-93.exe
share.exe
mallox.exe
hbatka.exe
FusContainer.exe
Ransom.exe
Ofdds.exe
DTEAOK7H.exe
arx777-Ofdds.exe
Yjnds.exe
arx777-ofdds.exe
yjnds.exe
Elastio Can Help You
Don't let Tohnichi ransomware take over your data
Elastio provides advanced ransomware protection and recovery solutions to keep your organization safe.
About This Analysis
This Tohnichi ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery solutions, helping organizations defend against and recover from ransomware attacks like Tohnichi.
Last updated: July 30, 2025