Behavioral analysis reports
High-profile software artifacts, analyzed without source code. Every finding traced to named functions and addresses.
Conti ransomware analysis: service-killing encryptor with network share targeting
Conti ransomware that issues hidden commands to stop security and backup services, then encrypts local and network-accessible files via CryptoAPI, renaming them to .CONTI and dropping a HOW_TO_DECRYPT.txt note.
Fake Google Docs Offline banking trojan analysis: overlays, token theft, and live operator takeover
A fake Google Docs Offline extension steals Brazilian banking and crypto credentials, hijacks sessions, and gives operators live control of victims' browsers.
Terra Drone Ukraine lure analysis: LNK shortcut downloads and runs VBE payload
A fake business plan themed on the Terra Drone and Ukraine drone alliance hides a Windows shortcut that downloads and runs a VBE script from a hard-coded IP.
10 reports
Conti ransomware analysis: service-killing encryptor with network share targeting
Conti ransomware that issues hidden commands to stop security and backup services, then encrypts local and network-accessible files via CryptoAPI, renaming them to .CONTI and dropping a HOW_TO_DECRYPT.txt note.
Fake Google Docs Offline banking trojan analysis: overlays, token theft, and live operator takeover
A fake Google Docs Offline extension steals Brazilian banking and crypto credentials, hijacks sessions, and gives operators live control of victims' browsers.
Terra Drone Ukraine lure analysis: LNK shortcut downloads and runs VBE payload
A fake business plan themed on the Terra Drone and Ukraine drone alliance hides a Windows shortcut that downloads and runs a VBE script from a hard-coded IP.
Inno Setup installer that contains a malicious native x64 payload
A trojanized Inno Setup installer carrying an embedded x64 payload that steals wallet, browser, and messenger data, captures screenshots, and exfiltrates to a hard-coded C2 while killing analysis tools.
JScript downloader analysis: Korean "fitness assignment" cover story hides a download, unzip, and execute chain
An obfuscated JScript downloader posing as a Korean university fitness assignment fetches and unzips a remote archive, drops a second payload, and runs it.
JScript loader analysis: fake Microsoft.Win32.TaskScheduler.dll staged through environment variables
A JScript loader hides a .NET payload across user environment variables, then runs it in memory via hidden PowerShell while posing as Microsoft's Task Scheduler library.
KarstoRAT analysis: Discord token theft, fodhelper UAC bypass, and on-command self-destruct
KarstoRAT gives operators a remote shell plus webcam, microphone, and keylogger access, steals Discord and browser tokens, and elevates itself via a fodhelper UAC bypass.
Linux backdoor analysis: kworker masquerade with root account tampering
A Linux backdoor posing as a kernel worker thread plants persistence, flushes firewall rules, tampers with root in /etc/passwd, and pulls follow-on payloads.
Multi-payload dropper analysis: process-injection stealer bundled with dork-generator tool
An Inno Setup-based dropper that writes randomized-name executables to AppData Roaming and launches them, including a child with code-backed capability for process injection, screenshot capture, and network communication.