Behavioral analysis reports
High-profile software artifacts, analyzed without source code. Every finding traced to named functions and addresses.
Conti ransomware analysis: service-killing encryptor with network share targeting
Conti ransomware that issues hidden commands to stop security and backup services, then encrypts local and network-accessible files via CryptoAPI, renaming them to .CONTI and dropping a HOW_TO_DECRYPT.txt note.
Fake Google Docs Offline banking trojan analysis: overlays, token theft, and live operator takeover
A fake Google Docs Offline extension steals Brazilian banking and crypto credentials, hijacks sessions, and gives operators live control of victims' browsers.
Terra Drone Ukraine lure analysis: LNK shortcut downloads and runs VBE payload
A fake business plan themed on the Terra Drone and Ukraine drone alliance hides a Windows shortcut that downloads and runs a VBE script from a hard-coded IP.
13 reports
StrUtilCore analysis: credential theft, supply-chain propagation, and conditional home-directory deletion
Native sidecars embed two additional builds, while cloud propagation uses S3 staging and Systems Manager command submission.
Static analysis of StrUtilCore reveals credential theft, nested native-loader payloads, cross-ecosystem propagation, and a conditional home-directory-deletion monitor.
Behavioral Comparison: Three Linux Go Beacons
Shared task handlers, different transports and task scheduling, with a duplicated-port address in one build.
Static analysis of three Linux Go beacons reveals shared remote-control handlers, TCP versus HTTP tasking, and a malformed destination in one build.
Tensorlake 0.5.144 supply-chain analysis: token-triggered home-directory deletion
The payload combines fixed-domain and Ethereum-based C2 selection, while exact CI checks block the loader in some build environments.
A compromised Tensorlake npm release steals credentials, runs server-supplied code, and can install a token monitor that deletes the user’s home directory on HTTP 400 through 409 responses.
Conti ransomware analysis: service-killing encryptor with network share targeting
Conti ransomware that issues hidden commands to stop security and backup services, then encrypts local and network-accessible files via CryptoAPI, renaming them to .CONTI and dropping a HOW_TO_DECRYPT.txt note.
Fake Google Docs Offline banking trojan analysis: overlays, token theft, and live operator takeover
A fake Google Docs Offline extension steals Brazilian banking and crypto credentials, hijacks sessions, and gives operators live control of victims' browsers.
Inno Setup installer that contains a malicious native x64 payload
A trojanized Inno Setup installer carrying an embedded x64 payload that steals wallet, browser, and messenger data, captures screenshots, and exfiltrates to a hard-coded C2 while killing analysis tools.
JScript downloader analysis: Korean "fitness assignment" cover story hides a download, unzip, and execute chain
An obfuscated JScript downloader posing as a Korean university fitness assignment fetches and unzips a remote archive, drops a second payload, and runs it.
JScript loader analysis: fake Microsoft.Win32.TaskScheduler.dll staged through environment variables
A JScript loader hides a .NET payload across user environment variables, then runs it in memory via hidden PowerShell while posing as Microsoft's Task Scheduler library.
KarstoRAT analysis: Discord token theft, fodhelper UAC bypass, and on-command self-destruct
KarstoRAT gives operators a remote shell plus webcam, microphone, and keylogger access, steals Discord and browser tokens, and elevates itself via a fodhelper UAC bypass.