Malware Analysis
Hands-on analysis of malware families, loaders, stealers, and ransomware.
- Agent Tesla: a four-layer .NET stealer unpacked
Agent Tesla (also called NegaSteal) is a .NET keylogger and credential stealer that has been around since 2014. Its popularity comes from cheap licences and…
- Akira ransomware: double extortion on Windows and Linux
Akira showed up in April 2023 and moved quickly from a handful of victims to a long list across several industries. I tracked it through the summer of 2023…
- AsyncRAT: configuration decryption, anti-analysis and 2023-2025 campaigns
AsyncRAT is one of the most used open-source remote access tools. It is a C# .NET program with screen viewing and recording, keylogging, antivirus checks…
- AZORult: three decryption layers and a batch-file switch
AZORult has been collecting banking details, crypto wallets, cookies, autofill data, desktop files and chat history since 2016. This note records how a…
- BazarLoader: password-protected zip to Cobalt Strike
BazarLoader spreads through email and exists mostly to prepare the ground for something bigger, typically Cobalt Strike and then ransomware.
- Bumblebee loader: ISO delivery, command strings and group tags
Bumblebee first appeared around March 2022. It delivers Cobalt Strike, Meterpreter, shellcode and in some cases ransomware, and it largely took over the…
- Clop ransomware: three launch modes, one service
Clop is a Windows ransomware family that behaves very differently depending on how it is started. These notes cover what I saw while stepping through a…
- Cobalt Strike payloads: AES shellcode, XOR shellcode and C2 profile hints
Cobalt Strike is a commercial post-exploitation toolkit that appears as the second stage of many infections. Common first-stage droppers include IcedID,…
- Conti: an encrypted entry point, API hiding and process injection
Conti is a ransomware-as-a-service operation. Affiliates frequently receive access that earlier loaders such as Trickbot or BazarLoader already established,…
- CVE-2017-11882: an RTF that abuses Equation Editor
CVE-2017-11882 is a memory corruption flaw in the old Equation Editor component bundled with Microsoft Office. A crafted document runs code as the current…
- Emotet 2022-2023: five infection chains in one place
Emotet (also Geodo and Heodo) began as a banking trojan in 2014 and turned into a modular loader for Trickbot, IcedID, Cobalt Strike and others. Interpol…
- FormBook: three stages down to a MASM payload
FormBook arrives mostly as a RAR attachment in spam mail containing an executable, usually a .NET (MSIL) file. It steals browser and mail credentials, takes…
- Gozi / Ursnif: from PDF lure to a layered Delphi DLL
Gozi, also called Ursnif or Dreambot, is a banking trojan that dates back to 2007 and became very active again from 2020. Its main jobs are recording…
- HermeticWiper (FoxBlade): destructive malware from the Ukraine campaigns
In early 2022, as tension around Ukraine escalated, several destructive tools appeared in quick succession. WhisperGate, a .NET wiper, came first, followed…
- LockBit 2.0 walkthrough: anti-debug, language gates and the wallpaper trick
LockBit began operating as ransomware-as-a-service in late 2019, and the 2.0 release in mid-2021 made it one of the most active families. Access is commonly…
- Oski Stealer: finding the payload in a .NET loader
Oski is a C++ stealer that appeared around November 2019 and was sold on Russian-language forums for roughly $70 to $100. It collects wallets, saved…
- Pikabot: six distribution methods and an anti-debug gauntlet
Pikabot is a backdoor active since early 2023. It gives other actors a way into the network for ransomware, crypto-mining, data theft and remote control.…
- Qakbot delivery chains, December 2021 to February 2023
Qakbot is a Delphi-based stealer and loader that can bring in Cobalt Strike and ransomware depending on the environment it lands in. The core DLL stayed the…
- Quantum ransomware: Salsa20, noisy SMB and an IcedID connection
Quantum appeared around August 2021 and is linked to the Quantum Locker operation. The affected organisations do not fall into a single industry or country,…
- Raccoon Stealer v2 and the Excel add-in delivery trick
Raccoon is an information stealer sold as a service since 2019. It went quiet in March 2022 and returned in June of that year as version 2.
- RedLine Stealer: XOR loader, RegSvcs injection and a fake YouTube bot
RedLine is a .NET information stealer spread through phishing mail, fake installers for popular apps and cracked software. One campaign abused YouTube:…
- Remcos RAT: Excel to VBS to PowerShell to RegAsm injection
Remcos is a commercial remote administration tool that criminals use as a RAT. The sample I looked at came from a phishing campaign that imitated a bank's…
- SolarMarker (Jupyter): how the .NET backdoor protocol changed
SolarMarker, also known as Jupyter, Polazert and Yellow Cockatoo, is a .NET backdoor and information stealer. Victims reach it through search results…
- Vidar Stealer: country checks, config download and self-cleanup
Vidar first surfaced in late 2018. It descends from the same code lineage as Arkei and Oski and is sold as malware-as-a-service. Distribution is usually…