Malware Analysis

Analysis Walkthrough: APT32’s {79828CC5–8979–43C0–9299–8E155B397281}.dll

CDRThief 新变种/New CDRThief Variant!

Exploring the new CDRThief Variant

It’s a BEE! It’s a… no, it’s ShadowPad.

Analysis walkthrough of ShadowPad variant 2020/2021 that…

Quarians, Turians and…QuickHeal

I was expecting to find an Asari or Salarian variant of this malware…

A Look into SUNBURST’s DGA

My attempt at a script that decodes all of SUNBURST’s DGA strings :)

Do you want to bake a donut? Come on, let’s go update~ Go away, Maria.

What happened between the BigBadWolf and the Tiger?

Shadows with a chance of BlackNix

A long post on analysis of a variant of BlackNix RATs, which are…

Shadows in the Rain

An analysis of a BBSRAT sample involving mutexes and C2 URL associated with the…

Dad! There’s A Rat In Here!

An analysis of the DADSTACHE sample fetched by the maldoc (MD5…