Introduction

Lab Scenario: You are currently working as a Malware Reverse Engineer for your organisation. Your team acts as a support for the SOC team…

Walking through ALPC from userland: avoiding hardcoded object indices, resolving query hangs, handling PPL boundries & verifying via…

Quick Tools/Resources

DFIR rooms hit different from your usual boot2root. No shells to pop, no root flag waiting at the end — just a suspicious binary, a pile of…

A practical walkthrough of catching packed malware in the act, without having to reverse every last instruction.

Covering Global/Local Variables, Loops, Switch Statements, and Function Calls and how attackers use them.

https://tryhackme.com/room/hh-packedlight-02e5330c

An in-depth reverse engineering walkthrough of the MalOps.io malware challenge.

Disclaimer: This article is for educational purposes only. It explains how modern malware operates to help security professionals and…

The system drive serial number or computer name magically transformed into an indispensable key. Without it, the malicious program simply refused to decrypt its own payload. Recently, Kaspersky re…

What initially appeared to be a routine Cobalt Strike Beacon turned out to be something considerably more dangerous. Researchers have now dissected SakDriver – a fully realized Windows rootk…

A technical walkthrough of deobfuscating JavaScript, dumping EVM bytecode, and resolving blockchain command and control infrastructure.

A digital forensics case study — how a fake “purchase order” almost bypassed Windows’ last line of defense

Yesterday, I tweeted asking people to share malware samples with me for analysis, for personal reasons.