Malware Report: A curated corpus of in-depth malware analyses

Abstract

This report summarizes a curated corpus of real-world malware analyses covering ransomware, remote-access trojans, and obfuscated PowerShell infostealers. Each family is documented with static and dynamic analysis, unpacking techniques, behavior profiling, persistence mechanisms, and network communication patterns. The objective is to extract indicators of compromise (IoCs), map attacker TTPs to MITRE ATT&CK, and translate findings into detection engineering and defensive guidance for SOC operations, threat hunting, and incident response.

• Key findings — ransomware variants (7ev3n-HONE$T, A.E.S.R.T), a modular RAT (DCrat), a phishing-invoice dropper campaign (KTMBE25040170), an obfuscated PowerShell crypto-wallet infostealer (GHOSTWEAVER), SMTP credential-exfil staging (VIP Recovery Mail), and an attempted PHPUnit RCE against a public web server.

Background

The collection targets the malware families most relevant to enterprise SOCs and blue teams. Because phishing is the dominant infection vector observed across the corpus, each report focuses on the artifacts a defender is most likely to encounter: malicious attachments, droppers, persistence, C2 beaconing, and the final credentials or wallet data being stolen.

Analysis was performed on isolated, non-production lab infrastructure using FLARE VM and REMnux, with process and network behavior captured via Procmon and Wireshark. All samples were hashed at acquisition, and indicators are defanged throughout.

Investigation

The corpus was analyzed under a repeatable methodology: static triage, sandbox detonation, behavioral capture, and IOC extraction.

• KTMBE25040170 / Count.exe — an invoice-themed phishing email delivered Attachment0.xz, which contained a mountable disk image (invoice_10988.img) inside which sat KTMBE25040170.exe. Execution dropped %TEMP%\Count.exe and persisted via Count.vbs in the Startup folder, then established outbound C2.
• Sandbox containment — every live sample was detonated inside a network-isolated snapshot, and all artifact paths are defanged to prevent accidental execution.

Technical Analysis

7ev3n-HONE$T (ransomware)

A 32-bit C-language ransomware delivered via phishing attachments, malicious ads, and torrent lures. On execution it drops to C:\Users\Public, installs a registry Run key (...\CurrentVersion\Run\allkeeper), then enumerates all drive letters and renames targeted files to .R5A. A ransom note is dropped as FILES_BACK.txt in each affected directory.

SHA-256  FFC23CBC60BDE91B2463DC98C575B6CC00AD8275804B6389605E65DD642CDA90

A.E.S.R.T (ransomware)

A 32-bit .NET/C# ransomware that encrypts files with the .AESRT extension. Instead of a ransom note, it displays a popup containing the attacker's email and a key-entry field. It deletes volume shadow copies to inhibit recovery.

SHA-256  05072A7EC455FDF0977F69D49DCAAF012C403C9D39861FA2216EAE19C160527F

DCrat — Dark Crystal RAT

A modular remote-access trojan active since 2018. A 32-bit C/VC++ PE that steals passwords, cryptocurrency wallets, and Telegram/Steam sessions. Most commonly distributed via phishing campaigns.

SHA-256  40603DF340CEE8C3D00939469470A28ACBF64401EC12D32BA68FE54E7F04C6D4

GHOSTWEAVER — obfuscated PowerShell infostealer

Indicators

Detection

rule PS_Crypto_Wallet_Infostealer
{
    meta:
        author = "Ali Chisom"
        description = "Detects obfuscated PowerShell crypto wallet stealers"
        severity = "high"
    strings:
        $s1 = "Local Extension Settings" ascii nocase
        $s2 = "SecurityCenter2" ascii
        $s3 = "Invoke-WebRequest" ascii
        $y1 = "Add-Type" ascii
        $y2 = "DllImport" ascii
    condition:
        6 of them
}

# Sigma — PowerShell wallet discovery
title: PowerShell Crypto Wallet Discovery
logsource:
  product: windows
  category: file_access
detection:
  selection:
    ProcessName: powershell.exe
    TargetFilename|contains:
      - "Local Extension Settings"
      - "wallets"
      - "keystore"
  condition: selection
level: high

Suricata — PowerShell C2 beacon
alert http any any -> any any (
    msg:"PowerShell Infostealer C2 POST";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"message="; http_client_body;
    classtype:trojan-activity; sid:900001; rev:1; )

MITRE ATT&CK — Initial Access T1566 · Execution T1059/T1204 · Persistence T1547 · Collection T1113/T1115 · Exfiltration T1041.

Mitigation

1. Block inbound email attachments with misleading double extensions; require disk-image mount approval in mail gateways.
2. Harden PowerShell: enforce Constrained Language Mode, monitor -ExecutionPolicy Bypass, and log all ScriptBlock activity.
3. Apply application-control policies (AppLocker/WDAC) to unsigned droppers and protect wallet/credential storage paths with file-read telemetry.
4. Keep volume shadow copies off-host; remove or restrict public exposure of PHPUnit eval-stdin.php.
5. Ingest the YARA, Sigma, and Suricata detections into Microsoft Defender, Splunk, Wazuh, and ELK.

References

1. 7ev3n-HONE$T Report (2025) — ransomware technical analysis.
2. A.E.S.R.T Report (2025) — ransomware technical analysis.
3. DCrat Report (2025) — RAT technical analysis.
4. KTMBE25040170 Report (2025) — payload and infection-chain analysis.
5. GHOSTWEAVER RAT Report (2026) — PowerShell infostealer analysis.
6. VIP Recovery Mail Analysis Report (2025) — SMTP exfiltration analysis.
7. Web Server Traffic Analysis Report (2025) — PHPUnit RCE attempt.
8. Corpus repository: github.com/PwnPoint/malware-report A heavily obfuscated PowerShell script executed via powershell.exe -ExecutionPolicy Bypass. It performs environment awareness and anti-analysis checks (terminating if debuggers, sandboxes, or VM artifacts are detected), profiles the domain, communicates with multiple C2 endpoints over plaintext HTTP POST, and enumerates browser and desktop cryptocurrency wallets for exfiltration. Analyzed behavior is consistent with commercial infostealer / crimeware-as-a-service operations.