https://fumik0.com/I turn stripped binaries into answers and valuable information. Malware teardowns since 2018, Randomizer and RE Engine tooling, LLM testing. Summary-only feed for slow connections.enWed, 11 Nov 2026 15:54:34 +0000Hugohttps://fumik0.com/2026/10/30/hack-yourself/Fri, 30 Oct 2026 10:00:00 +0100https://fumik0.com/2026/10/30/hack-yourself/ analysis // me.exe00/00 00% section intro nothing leaves your browser 00%▾ me.exe --speedrun SKIP CUTSCENE ▸▸ Short on time? The one-minute version This post takes about 20 minutes to read, so here is the whole idea in about one minute. You are welcome to stop after this card. …https://fumik0.com/2026/03/27/youre-not-the-worst-one-here/Fri, 27 Mar 2026 19:30:00 +0000https://fumik0.com/2026/03/27/youre-not-the-worst-one-here/Every morning I open my phone and there it is again. Another model dropped. Another framework that "changes everything." Another person on X/LinkedIn explaining, with quiet confidence, how they've already integrated AI into every corner of their workflow while the rest of us were …https://fumik0.com/2021/06/24/lu0bot-an-unknown-nodejs-malware-using-udp/Thu, 24 Jun 2021 08:37:41 +0000https://fumik0.com/2021/06/24/lu0bot-an-unknown-nodejs-malware-using-udp/In February and March 2021, a curious lightweight payload was observed coming from a well-known load-seller platform. Unlike classic info-stealers that are pushed at an industrial scale, this one looks different from the current landscape and trends. Feeling being in front of a …https://fumik0.com/2021/04/24/anatomy-of-a-simple-and-popular-packer/Sat, 24 Apr 2021 20:25:53 +0000https://fumik0.com/2021/04/24/anatomy-of-a-simple-and-popular-packer/It's been a while that I haven't release some stuff here and indeed, it's mostly caused by how fucked up 2020 was. I would have been pleased if this global pandemic hasn't wrecked me so much but i was served as well. Nowadays, with everything closed, corona haircut is new trend …https://fumik0.com/2019/12/25/lets-play-again-with-predator-the-thief/Wed, 25 Dec 2019 19:49:49 +0000https://fumik0.com/2019/12/25/lets-play-again-with-predator-the-thief/Whenever I reverse a sample, I am mostly interested in how it was developed, even if in the end the techniques employed are generally the same, I am always curious about what was the way to achieve a task, or just simply understand the code philosophy of a piece of code. It is a …https://fumik0.com/2019/08/27/haruko-malware-tracker-1-year-anniversary-update/Tue, 27 Aug 2019 06:36:50 +0000https://fumik0.com/2019/08/27/haruko-malware-tracker-1-year-anniversary-update/Hi folks, It's been one year since the tracker went live (tracker.fumik0.com, now retired), and over this past months, I understood that maintaining this solo project was definitely not an easy task. But, right now, Haruko is step by step a growing place that provides a start for …https://fumik0.com/2019/05/24/overview-of-proton-bot-another-loader-in-the-wild/Fri, 24 May 2019 12:27:36 +0000https://fumik0.com/2019/05/24/overview-of-proton-bot-another-loader-in-the-wild/Loaders nowadays are part of the malware landscape and it is common to see on sandbox logs results with "loader" tagged on. Specialized loader malware like Smoke or Hancitor/Chanitor are facing more and more with new alternatives like Godzilla loader, stealers, miners and plenty …https://fumik0.com/2019/05/03/lets-nuke-megumin-trojan/Fri, 03 May 2019 11:05:02 +0000https://fumik0.com/2019/05/03/lets-nuke-megumin-trojan/When you are a big fan of the Konosuba franchise, you are a bit curious when you spot a malware called "Megumin Trojan" (Written in C++) on some selling forums and into some results of sandbox submissions. Before some speculation about when this malware has appeared, this one is …https://fumik0.com/2019/03/25/lets-play-with-qulab-an-exotic-malware-developed-in-autoit/Mon, 25 Mar 2019 09:32:20 +0000https://fumik0.com/2019/03/25/lets-play-with-qulab-an-exotic-malware-developed-in-autoit/After some issues that kept me far away from my researches, it's time to put my hands again on some sympathetic stuff. This one is technically and finally my real first post of the year (The anti-VM one was a particular case). So today, we will dig into Qulab Stealer + Clipper, …https://fumik0.com/2019/02/27/cpu-power-usage-sandbox-evasive-technique/Wed, 27 Feb 2019 19:53:35 +0000https://fumik0.com/2019/02/27/cpu-power-usage-sandbox-evasive-technique/Hi Folks, I'm not usually in this kind of paper, but this time, I am exceptionally writing a really short one about something related to some VM evasive PoC. There is always some tricks to detect if you are running on a virtual machine or not. Most of them are stupid, but it's …https://fumik0.com/2018/12/24/lets-dig-into-vidar-an-arkei-copycat-forked-stealer-in-depth-analysis/Mon, 24 Dec 2018 09:32:01 +0000https://fumik0.com/2018/12/24/lets-dig-into-vidar-an-arkei-copycat-forked-stealer-in-depth-analysis/Sometimes when you are reading tons and tons of log of malware analysis, you are not expecting that some little changes could be in fact impactful. I paid the price when I was analyzing a supposed Arkei malware. my Yara rule at that time was supposed to trigger this malware, but …https://fumik0.com/2018/10/15/predator-the-thief-in-depth-analysis-v2-3-5/Mon, 15 Oct 2018 13:46:24 +0000https://fumik0.com/2018/10/15/predator-the-thief-in-depth-analysis-v2-3-5/Well, it's been a long time without some fresh new contents on my blog. I had some unexpected problems that kept me away from here and a lot of work (like my tracker) that explain this. But it's time to come back (slowly) with some stuff. So today, this is an In-Depth analysis of …https://fumik0.com/2018/05/21/some-fun-with-a-miner/Mon, 21 May 2018 08:39:17 +0000https://fumik0.com/2018/05/21/some-fun-with-a-miner/A few weeks ago I came across a malware that gave me some interests to dig more into it. It has a curious way to deploy itself, set up a miner on the machine and hide it behind some legit processes. In an example, when we look at Process Hacker : Visual Basic Compiler is launched …https://fumik0.com/2018/01/24/inside-one-xmrig-botnet-miner/Wed, 24 Jan 2018 15:12:42 +0000https://fumik0.com/2018/01/24/inside-one-xmrig-botnet-miner/This post is an extension of this article. I - Introduction At the beginning of this year, after some daily IoC Feeds. I was interested in one Linux sample on hybrid-analysis for two reasons : First, it's quite rare to see some stuff like this on public feeds. Secondly, the POST …