Research
14 articles, newest first.
Try stealer, packer, nodejs, or XOR.
Hack Yourself: Reversing the Program That Came Without a Manual
An interactive essay on reading the world, and myself, the way I read a malware sample: a program with no manual, a malware report on that program with six findings (Fun included), a triage window, a trace log, a breakpoint and a git history. The skills I thought were obsolete still transfer, once I learn to export them.
Read essay
You're Not the Worst One Here
A personal essay on keeping up with AI: the daily flood of new models and confident takes, and the feeling of being left behind.
Read essay
Lu0bot - An unknown NodeJS malware using UDP
An analysis of Lu0bot, a lightweight and previously unknown Node.js malware seen in early 2021 that talks to its server over UDP.
Read teardown
Anatomy of a simple and popular packer
A walkthrough of a simple, widely used packer: its architecture, the PE stub and the shellcode stages that unpack the final payload.
Read teardown
Let's play (again) with Predator the thief
A second look at Predator the Thief, focused on how a newer version of the stealer was built and what changed in its code.
Read teardown
Haruko Malware Tracker - 1 Year Anniversary Update
An update one year after launching Haruko, my solo malware tracker, and what it offers for OSINT work and learning malware analysis.
Read teardown
Overview of Proton Bot, another loader in the wild!
An overview of Proton Bot, a malware loader seen in the wild in 2019: how it works and what it can do.
Read teardown
Let's nuke Megumin Trojan
A reverse-engineering walkthrough of Megumin Trojan, a C++ malware sold on underground forums, and of what it can do.
Read teardown
Let's play with Qulab, an exotic malware developed in AutoIT
Qulab, a password stealer and clipper written in AutoIt: how its code is obfuscated and executed, its features and its Telegram bot C2.
Read teardown
CPU Power Usage - Sandbox Evasive Technique
A short proof of concept for detecting a virtual machine or sandbox by looking at CPU power usage.
Read teardown
Let's dig into Vidar - An Arkei Copycat/Forked Stealer (In-depth analysis)
An in-depth analysis of Vidar, an info-stealer forked from Arkei, and of how it differs from the malware it copies.
Read teardown
Predator The Thief: In-depth analysis (v2.3.5)
An in-depth analysis of Predator the Thief v2.3.5, an info-stealer written in C/C++, from its hidden C2 to the data it steals.
Read teardown
Some fun with a miner
A malware that deploys an XMRig miner and hides it behind legitimate Windows processes such as the Visual Basic compiler.
Read teardown
Inside one xmrig botnet miner
How a Linux xmrig cryptominer botnet spread from a compromised PHP site: the panel, the deployment scripts and the Monero wallets behind it.
Read teardown
No articles match that filter.