Crime and Punishment
A malware-analysis project focused on understanding execution, evasion, persistence, credential theft, and command-and-control below the network surface.
Crime and Punishment is a malware analysis project built to move beyond encrypted traffic and observe what malicious programs do at runtime. The work combines debugger traces, process inspection, deobfuscation, filesystem evidence, and network captures to reconstruct behavior from execution to exfiltration.
Three published investigations
- A game-trainer loader that resolves APIs dynamically, tampers with Defender, hollows a process, and launches XMRig
- A fake Photoshop installer that unfolds into infostealer, remote-access, and ransomware behavior
- A Discord account-takeover sample using anti-VM checks, process hollowing, credential discovery, and RC4-protected command-and-control
Analysis workflow
The investigations pair static reconnaissance with controlled dynamic analysis. Tools and evidence include x32dbg/x64dbg, process and memory inspection, packet capture, recovered strings and keys, API-resolution traces, and comparisons between the original process image and injected memory.
From repository to journal
The project repository is the source corpus; the Wzrd. research journal turns its three selected investigations into responsive articles with linked full-size evidence, searchable technical terms, and related-reading paths.