Mallox Ransomware Affiliate Uses PureCrypter in MS-SQL Attacks

**Executive summary:** This report documents the compromise of a Microsoft SQL honeypot through brute-force and MS-SQL exploitation leading to attempted deployment of Mallox ransomware via the PureCrypter loader, provides detailed analysis of exploitation patterns (CLR assemblies, xp_cmdshell, Ole Automation), PureCrypter and Mallox internals, affiliate identifiers and infrastructure (notably AS208091/XHost), and includes IoCs and practical detection recommendations for MS-SQL and endpoint telemetry.