This white paper investigates Weaxor ransomware, a rebranded variant of Mallox targeting vulnerable Microsoft SQL servers. It explains how attackers leverage sqlps.exe, obfuscated PowerShell, and Cobalt Strike shellcode for stealthy payload delivery. The document analyzes multiple payload stages, AMSI bypass techniques, process injection, and encrypted communications with C2 servers. It highlights advanced obfuscation and anti-analysis methods used to evade defenses. The paper concludes with IOC details and defensive insights to help organizations detect and mitigate SQL-based ransomware attacks.

Join for free to read