Oops... I Reverse Engineered It 👀
Most people avoid suspicious downloads. I deliberately collect them. If a file looks odd, behaves strangely, or makes me think “that can’t be right,” I’m probably downloading it, isolating it, and taking it apart until I understand what it’s trying to do
About Me 🙂↔️
Zenvoris is what happens when curiosity refuses to leave things alone.
This site is where I publish malware analysis, threat intelligence, vulnerability research, and whatever cybersecurity rabbit hole I’ve fallen into that week.
Sometimes that means reverse engineering a suspicious sample. Sometimes it means tracking attacker behavior. Sometimes it means staring at a script for three hours only to discover the malware author was held together by duct tape and bad decisions.
Everything here is researched, written, and maintained by one person. No corporate buzzwords. No AI-generated “10 Cybersecurity Trends You Need To Know” articles. Just research, analysis, and the occasional descent into digital madness.
Featured Research
Recent analyses, investigations, and questionable decisions made in the name of curiosity 😪
Obfuscated For "Reasons" 🧐
What started as "it's probably just another JavaScript sample" quickly evolved into digging through layers of obfuscation, suspicious functions, and enough weird logic to raise several questions. This writeup documents the investigation from initial triage to reverse engineering findings.
Overlord Agent - I Had Questions
Every malware analyst eventually opens a sample expecting a 30-minute investigation and loses an entire evening instead. This batch script led to a modular Go framework featuring Solana infrastructure discovery, plugin delivery, and a surprisingly ambitious architecture, enough functionality to convince me the author had far too much free time, just like me.
.DLL Inside A Bitmap 🤨
Reverse engineering has taught me that if something looks like an ordinary image, it's probably worth checking anyway. This investigation follows a multi-stage .NET loader that reconstructs an entire assembly from bitmap pixels before executing it entirely from memory. Apparently malware authors looked at images and thought, "Yeah... we can hide a DLL in there."
The Script Was Lying 🙃
What looked like a tiny VBScript turned into a full reverse engineering dive through Remcos RAT 7.2.6. Browser collection, TLS networking, screenshots, clipboard access, process enumeration, and enough modular code to remind me that "small loader" rarely means "small investigation."
Paranoid By Design 🔍
What looked like another JavaScript sample turned into a full multi-stage malware investigation spanning JavaScript, PowerShell, and .NET. Instead of executing the malware, every stage was reconstructed statically until the managed loader emerged piece by piece.
Node.js Was The Payload All Along 💀
expected another JavaScript loader. Instead I found a malware framework that downloaded its own Node.js runtime, built PowerShell on the fly, and talked to its C2 using a custom TCP protocol.
Living Off The Land... Again. 🌱
The malware treated GitHub like a software distribution platform, staged its payload through trusted Windows binaries, and quietly exfiltrated stolen data over encrypted SMTP. Modern malware doesn't always need exotic infrastructure.
The Malware Had Standards 😭
This wasn't a "download and run" malware. It profiled the machine, inspected the domain, checked the country, and quietly decided whether the target deserved a second-stage payload.
Found something strange? Send it my way
Submit@zenvoris.com
Research Division of Archelox
Professional services solve problems. Research asks better questions. Zenvoris exists for the latter.
© Zenvoris 2026 All Rights Reserved.
Danyal@zenvoris.com