Work

Research I published and tools I built.

Published research

Reports and teardowns

Published, indexed and cited by other security teams.

01 Report · 2021

RM3

The banking malware that targeted more than 130 banks, taken apart module by module.

Publisher
Fox-IT / NCC Group
Indexed
Malpedia
Open the report
02 Teardown · 2018

Vidar

An Arkei fork, and how it differs from the malware it copies.

Cited by
Infoblox, Botconf 2024 proceedings
Includes
21 hashes, four YARA rules, MITRE mapping
Read the analysis
03 Teardown · 2021

Lu0bot

Previously unknown Node.js malware that talks to its server over UDP.

Method
Taken apart stage by stage
Focus
The UDP protocol
Read the analysis

All 14 articles

01 Resident Evil and Onimusha

Randomizers

Reshuffled keys, items and enemies, with every run proven finishable.

Since
2024
  • 1.4M+seeds generated
  • 60,000+players
  • 80%of players came back for a second seed

Try the graph solver

Resident Evil 2 Remake key artResident Evil 2 Remake
Resident Evil Village key artResident Evil Village
Onimusha Way of the Sword key artOnimusha Way of the Sword
Game art belongs to Capcom and Koei Tecmo. Resident Evil and Onimusha are their trademarks.

02 Overleaf fork

Overcook

A self-hosted LaTeX editor with an AI agent inside.

Status
Private
Since
2026
  • Fork of Overleaf Community Edition 6.3.2
  • Full TeX Live image
  • OpenCode agent runs inside the container
  • olsync, a command line sync between Overleaf and Git
The Overcook editor: LaTeX source on the left, the compiled paper on the right, and the Overcook Agent panel under the source describing the edits it made.
The agent panel sits under the source and edits the paper in place. Overcook is an independent, self-hosted fork of Overleaf Community Edition 6.3.2. Overleaf is a trademark of its owners.

03 Deployment monitor

Cosmo

Watches your Git repositories and redeploys on every new commit.

Status
Private
Since
2026
  • Clones, builds and runs Docker projects
  • Live logs and status
  • Reached through an SSH tunnel, no login of its own
A Cosmo project page: deploy controls, deployed and upstream commit, last deploy result, and a running, healthy container. The Cosmo form for adding a project from a Git repository, a Docker image or a compose file.
A project page and the add form. Names are redacted. Cosmo is private and reached through an SSH tunnel.
Resident Evil 3: Last Escape (1999 PlayStation) key art

04 Speedrun tool · since 2024

REviewer

Live timer, inventory and enemy tracking for the original Resident Evil games.

Resident Evil 1, 2 and 3. Splits and key items on screen. Works with BioRand randomizers. Artwork belongs to Capcom.

The Haruko tracker: its logo above a table of malware samples.

05 Malware tracker · 2018–2019

Haruko

A public tracker of malware samples, with an open API.

2,600+ samples. Built solo. Retired.

Read the story

Public repositories

Tools and scripts

Unpackers, detection rules, and debugger configuration published on GitHub.

01 Python 102 stars16 forks

scripts

Standalone unpackers and C2 configuration extractors written alongside my 2018–2019 malware teardowns.

Targets
Adderall Protector, Vidar, Megumin
Scripts
mikuru.py, izanami.py, ohana.py, shiina.py
Repo
fmk0/scripts
Open on GitHub
02 YARA 8 stars3 forks

yara

Signature rules written from unpacked samples to classify stealers, loaders, and trojans in the wild.

Coverage
12 malware families
Includes
Vidar, Arkei, Predator, Qulab, Proton Bot
Repo
fmk0/yara
Open on GitHub
03 x64dbg 35 stars3 forks

templates

High-contrast dark interface stylesheet for x64dbg and x32dbg, tuned for long analysis sessions.

Debugger
x64dbg & x32dbg
Format
Qt stylesheet & colour scheme
Repo
fmk0/templates
Open on GitHub