#malware-analysis

“I understand it now.”: Adaptive Rule-Based Security

Malregistry: A semi-automated malware pipeline that parses and generates adaptive rules for malware.

1337_GTWK Linux Malware Analysis

This is the second part of a two-part series about a new Linux malware sample that I analysed (Click here for Part 1). In Part 1, we…

Malicious Excel File (CVE-2017–0199)

Hello all and welcome back to share in my blog.

Userland ALPC Enumeration: Dynamic & PPL-Aware Approach

Walking through ALPC from userland: avoiding hardcoded object indices, resolving query hangs, handling PPL boundries & verifying via…

พฤติกรรมการใช้บล็อกเชนร่วมกับ C2 เพื่อกระจายคำสั่งมัลแวร์

ทุกวันนี้โลกได้เปลี่ยนไปแล้วอย่างมาก พฤติกรรมของ Attacker ก็เช่นกัน เมื่อเทคโนโลยีก้าวหน้าขึ้นในทุกๆวัน…

Intro to Malware…… | THM Walkthrough | by Dharavath Nagaraju

This room introduces the fundamentals of malware analysis and the techniques used to safely investigate malicious software. It covers the…

I Detonated Real Ransomware in a VM. Here’s the Forensic Trail It Left.

Static analysis hit a wall immediately. The only way to understand this malware was to actually let it run.

Understanding Cyber Threats: The First Step to Staying Secure

Every day, individuals and organizations face cyber threats that can compromise personal data, finances, and privacy. A cyber threat is any…

Panda Banker Malware Analysis — Part 1: From Original File to Memory Dump

Level: Basic — Intermediate

Malware Binary Diffing with Ghidra & BinDiff: Comparing Conti and LockBit Green

How to use Ghidra, BinExport, and BinDiff to compare ransomware binaries and uncover similarities that traditional static analysis can…

Cyberdefenders — 3CX Supply Chain Lab

Soc Tier 1, Level 4 Lab

I watched Alpha…🎥

Or Alpha watched me? 🫣

X-Raying Technology: The Hidden World of Reverse Engineering

Extracting Blueprints from the Man-Made World

The 21-Month Blind Spot: Why DCRat is still Evading Enterprise Defenses in 2026

Threat Intelligence Report: DCRat Commodity RAT Ecosystem

Reverse Engineering the Simda Malware Loader: From Packed Binary to C2 Infrastructure

An in-depth analysis of the Simda malware loader using static and dynamic analysis techniques to uncover payload decryption, anti-analysis…

I Wrote a Windows PE File From Scratch, in Assembly

AI From First Principles has one piece left — Transformers, from the ground up. After that I’m diverting: technical reports, reverse…

Anatomy of a Shellcode: A Deep Dive into Runtime Execution Internals

Deconstructing the assembly DNA of modern exploits — how shellcode resolves APIs, hashes function names, and strikes from the shadows

I Opened a "Clean" File in Detect It Easy. In 60 Seconds, I Knew It Was Malware.

Rokarolla: What Every Android Developer Needs to Know About the 2026 Trojan That Takes Over Your…

You spent months building your banking app. You followed every security guideline. SSL pinning. Obfuscation. Biometric authentication.

Deep Dive Into Moka: Analyzing a Babylon RAT-Based Information Stealer and Keylogger

Executive Summary

Triage & Evasion: Unpacking Qakbot via Native API Carving

About the Author

SOC 101 — TCPDump Challenge 1 — Info-Stealer Network Investigation

This analysis was conducted by Islam Diab, a Security Analyst & Researcher with a focus on Blue Team Operations, Malware Analysis & Reverse…

Building a Malware Analysis Sandbox with VirtualBox, REMnux and FLARE VM

A walkthrough of setting up an isolated lab for detonating malware safely, and the networking problems that got in the way.

A List of Every Cybersecurity Abbreviation There Is (Part 9)

Cybersecurity Has Over 1,000 Abbreviations. This Series Lists Them All…

The Invisible Macro: Defeating Gamaredon’s Remote Template Injection and COM Hijacking

Malware analysis is rarely a straight line from detonation to detection. We build isolated labs, set up our sinkholes, and write our…

Your Next Job Applicant Could Be a Hacker: Inside a Sophisticated Resume Malware Scheme

How threat actors are turning a recruiter’s most trusted tool into a silent, corporate data-stealing weapon.

Automated Shellcode Triage and API Hash Resolution

A practical workflow with capa, Binary Ninja, and the OALabs HashDB

I Opened a MISP Event and Accidentally Walked Into a Cyber-Espionage Campaign | BTLO Gifted Crooks…

I opened this BTLO challenge expecting malware.

The C2 You Can’t Take Down: Dissecting a Polygon-Hosted EtherHiding Loader

How a few hundred bytes of injected JavaScript turned a public blockchain into a bulletproof command-and-control channel — and how I…

Protecting 50,000 Users: How ANY.RUN Drives Incident Prevention at UMass Boston

Securing a university means defending a highly open environment, where thousands of users, devices, and external connections create…

Total Antivirus: The Easiest Way to Secure Your Windows

Securing your personal computer shouldn’t feel like rocket science. With digital risks evolving daily, finding a straightforward shield for…

Building MalTrace: A Behavioral Malware Analysis Pipeline with Explainable AI

How I built a malware analysis pipeline using CAPEv2 sandbox reports, Random Forest classification, SHAP explanations, MITRE ATT&CK…

JOMANGY: Backdoor Overview

JOMANGY is a PHP webshell and backdoor family targeting vulnerable FreePBX servers. It is designed to establish long-term access to…

Malware ve Analizi

Geliştirdiğimiz statik analiz (PE Analyzer) aracının arkasında dönen mimariyi tam olarak kavramak; bilgisayar donanımının, işletim…

Why Antivirus Pro Is the Most Secure Malware Removal Software

The modern internet presents a shifting landscape of digital hazards that target unprotected operating systems daily. Standard clean up…

The Glitch in the Code: Trapping AC Between the SIEM and the Wire

Malware analysis rarely goes exactly according to the textbook. You fire up your isolated virtual lab environment, map out your subnet, and…

The Malware Analyst’s Scalpel: How Debugging Forces Malware to Reveal Its Secrets

Inside the reverse-engineering technique analysts use to pause malware, inspect memory, and control execution in real time

Anatomy of an npm Supply Chain Attack: Deconstructing the “jwtmode” Typosquat

As developers, our daily workflow relies heavily on open-source ecosystems. A simple package addition brings in millions of lines of code…

Analyze Malware From Your Phone -Meet Jarvis, My AI-Powered Telegram Bot

Drop a binary from your phone. Text the bot. Get a Malware Analysis report.

Katz Stealer: Reverse Engineering a Information Stealer

A Complete Malware Analysis Walkthrough of the MalOps.io Challenge From C2 Communications to Browser Injection and Credential Theft

Cracking the Code: Deobfuscating a Macro-Based Phishing Attack (TryHackMe Walkthrough: Mr. Phisher)

❤️بِسْمِ اللهِ والصَّلَاةُ وَالسَّلَامُ عَلَى رَسُولِ اللهِ

Leader in Malware Analysis: ANY.RUN Named Top Vendor in G2 Summer 2026 Awards

We are proud to announce that ANY.RUN has earned the title of Momentum Leader and ranked #1 in the Relationship Index in the latest G2…

Q1 2026 Cyber Risk Report: Insights from 2.1 Million Malware and Phishing Investigations

Based on 2,101,483 malware and phishing investigations from Q1 2026, ANY.RUN’s Cyber Risk report provides a real-world view of modern…

What a Week of SSH Honeypot Logs Taught Me

Part 2: Autopsy of a Botnet Payload

Release Notes: Decision-Ready SOC Reporting, Elastic Security Integration, and 1400+ Threat…

Security leaders are under growing pressure to reduce the time between threat detection and response without adding more complexity to…

From Fake Purchase Orders to Remote Access: Analyzing the JS.MonoGlyphRAT Threat to US Enterprises

A previously unidentified cyberattack is quietly spreading through US businesses — and most security tools are not catching it. Researchers…

Why Encoding Payloads No Longer Beats Antivirus And Why It Still Matters

The Reality Check: Why Encoding Does Not Bypass Modern AV

Kali365: PhaaS Overview

Kali365 is an emerging Phishing-as-a-Service (PhaaS) platform that targets Microsoft 365 environments by stealing OAuth authentication…

Analysis of DirtyFrag (Vulnerability)

Reverse Engineering Atomic macOS Stealer (AMOS): From XOR Cipher to C2 Server

Uncovering XOR-obfuscated strings, LaunchAgent persistence, cryptocurrency wallet theft, and the malware’s command-and-control…