Into the Vo1d: Hunting a Botnet Hidden in TV Boxes
A BSides Lisbon talk connecting malware analysis, DNS intelligence, and sinkhole telemetry in an Android TV botnet investigation.
Reversing
Hunting PrivateLoader: The Malware Behind InstallsKey PPI Service
Tracing changes in PrivateLoader protocols and string obfuscation, with YARA and Suricata detection.
Tofsee Botnet: Proxying and Mining
Investigating the proxying, spam, and cryptocurrency-mining activity of the modular Tofsee botnet.
Unpacking Colibri Loader: A Russian APT-linked Campaign
A Colibri Loader unpacking walkthrough covering anti-analysis techniques, string decryption, and YARA detection.
Decrypting and Hunting PrivateLoader
Building a PrivateLoader string decryptor and YARA rule from a stack-based XOR pattern.