Malware analysis reports produced by static analysis, without running the samples unless the report says otherwise. Each report separates what was observed, derived, inferred and left unverified, and lists indicators of compromise.
Reports are published in their original language.
Keyed Rust encryptor for Windows: it removes recovery points, stops services and processes, then encrypts local and network files (ChaCha20, per-file key wrapped with RSA-2048) and spreads through PsExec. Static analysis, sample never executed.
56e1d092c07322d9…a4d2f7e7Go ransomware obfuscated with garble: execution flow, X25519 + XChaCha20 encryption, partial encryption of large files, lateral movement, keys in memory, indicators and ATT&CK. No cryptographic flaw found; a memory dump is the only lead for a key.
3ab9575225e00a83…5c5c9235Short version of the dossier: method, obstacles met, attack flow, encryption and how to detect it.
3ab9575225e00a83…5c5c9235Go infostealer and remote-access tool: primary C2 with TON-domain fallback, theft from browsers, Discord, Steam, Telegram and wallets, keylogger, screenshots. Config read from memory after a network-less sandbox run; two YARA rules included.
cd9c972e46b2cf28…6e2a006732-bit .NET RAT obfuscated with Eazfuscator, config decrypted without execution: two C2 servers on port 80, persistence through Run key and scheduled task, surveillance plugin (keylogger, password theft).
51ef4a7863a92198…593f6753