Malware, mystery files, and the occasional existential crisis....😮‍💨

Technical research, malware analysis, and the occasional deep dive into code written by people who were clearly making it everyone else’s problem. I’ll keep updating these entries regularly..So stay tuned!

The Loader From Hell 😭

It looked like an obfuscated JavaScript file. It absolutely was not. What followed was WSH, hidden PowerShell, AES encryption, a .NET payload, custom cryptography, manual API resolution, runtime code patching, and an embedded PE hiding another layer underneath. This one kept getting worse.

Ransomware With Trust Issues 💀

This Rust-based ransomware didn’t just encrypt files. It checked for debuggers and VMs, tampered with AMSI and ETW, went after Defender, deleted Shadow Copies, established persistence, talked to Telegram, and even carried a remote /stop command. The encryption itself is still hiding some answers.

The Malware Had A Kissing Emoji 💋

What started as a 1.18 MB JavaScript file full of Unicode garbage turned into a multi-stage XWorm infection chain involving WMI, PowerShell, JPEG payload carriers, an in-memory .NET loader, AES-encrypted configuration, and a final PE payload. Somewhere along the way, the author decided to give a kiss.

The Browser Was Not Mine Anymore 👀

What looked like a Brazilian financial utility turned into a multi-stage banking trojan with PowerShell, browser injection, session theft, Puppeteer, and remote browser control. It even came with bank-specific automation for Brazilian financial institutions.

The Code Wasn't Cooperating 😭

This .NET RAT went out of its way to make reverse engineering painful: flattened control flow, randomized identifiers, encrypted data, and a dispatcher spanning more than 13,000 bytes. So I stopped trying to make it behave and watched what it revealed at runtime instead.

It Was Just A 1.3 MB EXE. Surely. 💀

What looked like a fairly ordinary 32-bit .NET executable turned into a fully interactive RAT with obfuscated strings, WMI reconnaissance, persistent TCP C2, a custom binary protocol, eight command handlers, dynamic assembly loading, and server-directed payload execution.

Fun Section!

Malware analysis is serious business. My music taste is not. Every week I’ll throw a different song here that’s currently occupying 90% of my brain. If you’ve got recommendations, send them my way 😎