Amadey and StealC: Malware-as-a-Service Unavailable
C2 mapping, malware emulation, and infection telemetry supporting the Amadey and StealC disruption.
Loader
Into the Vo1d: Hunting a Botnet Hidden in TV Boxes
A BSides Lisbon talk connecting malware analysis, DNS intelligence, and sinkhole telemetry in an Android TV botnet investigation.
Hunting PrivateLoader: The Malware Behind InstallsKey PPI Service
Tracing changes in PrivateLoader protocols and string obfuscation, with YARA and Suricata detection.
Unpacking Colibri Loader: A Russian APT-linked Campaign
A Colibri Loader unpacking walkthrough covering anti-analysis techniques, string decryption, and YARA detection.
Tracking PrivateLoader: Malware Distribution Service
Tracking PrivateLoader delivery chains and identifying 30 malware families in the collected payloads.
Decrypting and Hunting PrivateLoader
Building a PrivateLoader string decryptor and YARA rule from a stack-based XOR pattern.