Amadey and StealC: Malware-as-a-Service Unavailable
C2 mapping, malware emulation, and infection telemetry supporting the Amadey and StealC disruption.
Research
Published investigations, technical walkthroughs, and talks on malware, botnets, and the infrastructure behind them.
Into the Vo1d: Hunting a Botnet Hidden in TV Boxes
A BSides Lisbon talk connecting malware analysis, DNS intelligence, and sinkhole telemetry in an Android TV botnet investigation.
Exfiltration over Telegram Bots: Skidding Infostealer Logs
An investigation of Telegram bot exfiltration, infostealer log formats, and the visibility those records provide.
Hunting PrivateLoader: The Malware Behind InstallsKey PPI Service
Tracing changes in PrivateLoader protocols and string obfuscation, with YARA and Suricata detection.
Data Insights on AgentTesla and OriginLogger Victims
Configuration and infection-data analysis of AgentTesla and OriginLogger, including their exfiltration methods.
Tofsee Botnet: Proxying and Mining
Investigating the proxying, spam, and cryptocurrency-mining activity of the modular Tofsee botnet.
Unpacking Colibri Loader: A Russian APT-linked Campaign
A Colibri Loader unpacking walkthrough covering anti-analysis techniques, string decryption, and YARA detection.
Tracking PrivateLoader: Malware Distribution Service
Tracking PrivateLoader delivery chains and identifying 30 malware families in the collected payloads.
Decrypting and Hunting PrivateLoader
Building a PrivateLoader string decryptor and YARA rule from a stack-based XOR pattern.
FluBot Persists: Infecting Europe and Australia
A historical investigation of FluBot distribution, infection telemetry, and its domain-generation algorithm.
Backdoors Pre-Installed on Cheap Android Devices
Sinkhole observations of pre-installed Android threats and insecure device-update mechanisms.
Fraudulent Ads SDK Installed on 15 Million Android Devices
An Android advertising SDK investigation, with a historical appendix of sample hashes, package names, and domains.