Remus Stealer: C2 Protocol Analysis, Cryptography, and Detection
Disclaimer: This blog and all associated research are part of my personal independent study. All hardware, software, and infrastructure are personally owned ...
Posts by Tag
- reverse-engineering 8
- ida-pro 8
- ransomware 4
- jetson 2
- nvidia 2
- machine-learning 2
- c2-protocol 2
- rust 2
- windows 2
- chacha20 2
- pytorch 1
- cuda 1
- malware-detection 1
- edge-inference 1
- matanbuchus 1
- loader 1
- obfuscation 1
- gridtide 1
- google-sheets 1
- apt 1
- qilin 1
- 0apt 1
- edr-killer 1
- blacksanta 1
- byovd 1
- dll-sideloading 1
- process-hollowing 1
- interlock 1
- freebsd 1
- esxi 1
- vect 1
- salsa20 1
- curve25519 1
- lateral-movement 1
- stealer 1
- remus 1
- lumma 1
- etherhiding 1
- c2-analysis 1
- x64dbg 1
- wireshark 1
- detection-engineering 1
reverse-engineering
VECT 2.0 Ransomware: Deep Dive into a C++ Windows Encryptor
VECT 2.0 Ransomware — Deep Dive Analysis
Interlock Ransomware: Deep Dive into a C-Based FreeBSD Encryptor
Interlock Ransomware: Deep Dive into a C-Based FreeBSD Encryptor
BlackSanta EDR Killer: Deep Dive into DWrite.dll (Part 1 — Loader Analysis)
Scope: This is Part 1 of the BlackSanta analysis series, focusing exclusively on the DWrite.dll loader component. Part 2 will cover the BlackSanta EDR-kil...
0APT Ransomware: Deep Dive into a Rust-Based Windows Encryptor
0APT Ransomware: Deep Dive into a Rust-Based Windows Encryptor
Qilin Ransomware (Rust Variant) Analysis
Qilin Ransomware (Rust Variant) Analysis
Tearing Apart GRIDTIDE: Reversing a Google Sheets Backdoor and Rebuilding Its C2
Analysis of GRIDTIDE — a Linux x86-64 backdoor using the Google Sheets API as a bidirectional C2 channel. AES-128-CBC config decryption, OAuth2 JWT Bearer au...
Matanbuchus 3.0 — A Deep Dive into a Loader-as-a-Service
A comprehensive reverse-engineering analysis of Matanbuchus 3.0, covering its multi-layered obfuscation framework, encrypted C2 protocol, command dispatch ar...
ida-pro
Remus Stealer: C2 Protocol Analysis, Cryptography, and Detection
Disclaimer: This blog and all associated research are part of my personal independent study. All hardware, software, and infrastructure are personally owned ...
VECT 2.0 Ransomware: Deep Dive into a C++ Windows Encryptor
VECT 2.0 Ransomware — Deep Dive Analysis
Interlock Ransomware: Deep Dive into a C-Based FreeBSD Encryptor
Interlock Ransomware: Deep Dive into a C-Based FreeBSD Encryptor
BlackSanta EDR Killer: Deep Dive into DWrite.dll (Part 1 — Loader Analysis)
Scope: This is Part 1 of the BlackSanta analysis series, focusing exclusively on the DWrite.dll loader component. Part 2 will cover the BlackSanta EDR-kil...
0APT Ransomware: Deep Dive into a Rust-Based Windows Encryptor
0APT Ransomware: Deep Dive into a Rust-Based Windows Encryptor
Qilin Ransomware (Rust Variant) Analysis
Qilin Ransomware (Rust Variant) Analysis
Tearing Apart GRIDTIDE: Reversing a Google Sheets Backdoor and Rebuilding Its C2
Analysis of GRIDTIDE — a Linux x86-64 backdoor using the Google Sheets API as a bidirectional C2 channel. AES-128-CBC config decryption, OAuth2 JWT Bearer au...
Matanbuchus 3.0 — A Deep Dive into a Loader-as-a-Service
A comprehensive reverse-engineering analysis of Matanbuchus 3.0, covering its multi-layered obfuscation framework, encrypted C2 protocol, command dispatch ar...
ransomware
VECT 2.0 Ransomware: Deep Dive into a C++ Windows Encryptor
VECT 2.0 Ransomware — Deep Dive Analysis
Interlock Ransomware: Deep Dive into a C-Based FreeBSD Encryptor
Interlock Ransomware: Deep Dive into a C-Based FreeBSD Encryptor
0APT Ransomware: Deep Dive into a Rust-Based Windows Encryptor
0APT Ransomware: Deep Dive into a Rust-Based Windows Encryptor
Qilin Ransomware (Rust Variant) Analysis
Qilin Ransomware (Rust Variant) Analysis
jetson
Malware ML Lab – Part 1: Setting Up My Jetson Orin Nano Research Node
Building a dedicated edge ML node for malware research — from unboxing to a working containerized environment on the NVIDIA Jetson Orin Nano.
Malware ML Lab – Part 2: Validating the Jetson ML Environment
Verifying that PyTorch, CUDA, and GPU training all work end-to-end inside the Jupyter container on the Jetson Orin Nano.
nvidia
Malware ML Lab – Part 1: Setting Up My Jetson Orin Nano Research Node
Building a dedicated edge ML node for malware research — from unboxing to a working containerized environment on the NVIDIA Jetson Orin Nano.
Malware ML Lab – Part 2: Validating the Jetson ML Environment
Verifying that PyTorch, CUDA, and GPU training all work end-to-end inside the Jupyter container on the Jetson Orin Nano.
machine-learning
Malware ML Lab – Part 1: Setting Up My Jetson Orin Nano Research Node
Building a dedicated edge ML node for malware research — from unboxing to a working containerized environment on the NVIDIA Jetson Orin Nano.
Malware ML Lab – Part 2: Validating the Jetson ML Environment
Verifying that PyTorch, CUDA, and GPU training all work end-to-end inside the Jupyter container on the Jetson Orin Nano.
c2-protocol
Tearing Apart GRIDTIDE: Reversing a Google Sheets Backdoor and Rebuilding Its C2
Analysis of GRIDTIDE — a Linux x86-64 backdoor using the Google Sheets API as a bidirectional C2 channel. AES-128-CBC config decryption, OAuth2 JWT Bearer au...
Matanbuchus 3.0 — A Deep Dive into a Loader-as-a-Service
A comprehensive reverse-engineering analysis of Matanbuchus 3.0, covering its multi-layered obfuscation framework, encrypted C2 protocol, command dispatch ar...
rust
0APT Ransomware: Deep Dive into a Rust-Based Windows Encryptor
0APT Ransomware: Deep Dive into a Rust-Based Windows Encryptor
Qilin Ransomware (Rust Variant) Analysis
Qilin Ransomware (Rust Variant) Analysis
windows
Remus Stealer: C2 Protocol Analysis, Cryptography, and Detection
Disclaimer: This blog and all associated research are part of my personal independent study. All hardware, software, and infrastructure are personally owned ...
VECT 2.0 Ransomware: Deep Dive into a C++ Windows Encryptor
VECT 2.0 Ransomware — Deep Dive Analysis
chacha20
Remus Stealer: C2 Protocol Analysis, Cryptography, and Detection
Disclaimer: This blog and all associated research are part of my personal independent study. All hardware, software, and infrastructure are personally owned ...
VECT 2.0 Ransomware: Deep Dive into a C++ Windows Encryptor
VECT 2.0 Ransomware — Deep Dive Analysis
pytorch
Malware ML Lab – Part 2: Validating the Jetson ML Environment
Verifying that PyTorch, CUDA, and GPU training all work end-to-end inside the Jupyter container on the Jetson Orin Nano.
cuda
Malware ML Lab – Part 2: Validating the Jetson ML Environment
Verifying that PyTorch, CUDA, and GPU training all work end-to-end inside the Jupyter container on the Jetson Orin Nano.
malware-detection
Malware ML Lab – Part 1: Setting Up My Jetson Orin Nano Research Node
Building a dedicated edge ML node for malware research — from unboxing to a working containerized environment on the NVIDIA Jetson Orin Nano.
edge-inference
Malware ML Lab – Part 1: Setting Up My Jetson Orin Nano Research Node
Building a dedicated edge ML node for malware research — from unboxing to a working containerized environment on the NVIDIA Jetson Orin Nano.
matanbuchus
Matanbuchus 3.0 — A Deep Dive into a Loader-as-a-Service
A comprehensive reverse-engineering analysis of Matanbuchus 3.0, covering its multi-layered obfuscation framework, encrypted C2 protocol, command dispatch ar...
loader
Matanbuchus 3.0 — A Deep Dive into a Loader-as-a-Service
A comprehensive reverse-engineering analysis of Matanbuchus 3.0, covering its multi-layered obfuscation framework, encrypted C2 protocol, command dispatch ar...
obfuscation
Matanbuchus 3.0 — A Deep Dive into a Loader-as-a-Service
A comprehensive reverse-engineering analysis of Matanbuchus 3.0, covering its multi-layered obfuscation framework, encrypted C2 protocol, command dispatch ar...
gridtide
Tearing Apart GRIDTIDE: Reversing a Google Sheets Backdoor and Rebuilding Its C2
Analysis of GRIDTIDE — a Linux x86-64 backdoor using the Google Sheets API as a bidirectional C2 channel. AES-128-CBC config decryption, OAuth2 JWT Bearer au...
google-sheets
Tearing Apart GRIDTIDE: Reversing a Google Sheets Backdoor and Rebuilding Its C2
Analysis of GRIDTIDE — a Linux x86-64 backdoor using the Google Sheets API as a bidirectional C2 channel. AES-128-CBC config decryption, OAuth2 JWT Bearer au...
apt
Tearing Apart GRIDTIDE: Reversing a Google Sheets Backdoor and Rebuilding Its C2
Analysis of GRIDTIDE — a Linux x86-64 backdoor using the Google Sheets API as a bidirectional C2 channel. AES-128-CBC config decryption, OAuth2 JWT Bearer au...
qilin
Qilin Ransomware (Rust Variant) Analysis
Qilin Ransomware (Rust Variant) Analysis
0apt
0APT Ransomware: Deep Dive into a Rust-Based Windows Encryptor
0APT Ransomware: Deep Dive into a Rust-Based Windows Encryptor
edr-killer
BlackSanta EDR Killer: Deep Dive into DWrite.dll (Part 1 — Loader Analysis)
Scope: This is Part 1 of the BlackSanta analysis series, focusing exclusively on the DWrite.dll loader component. Part 2 will cover the BlackSanta EDR-kil...
blacksanta
BlackSanta EDR Killer: Deep Dive into DWrite.dll (Part 1 — Loader Analysis)
Scope: This is Part 1 of the BlackSanta analysis series, focusing exclusively on the DWrite.dll loader component. Part 2 will cover the BlackSanta EDR-kil...
byovd
BlackSanta EDR Killer: Deep Dive into DWrite.dll (Part 1 — Loader Analysis)
Scope: This is Part 1 of the BlackSanta analysis series, focusing exclusively on the DWrite.dll loader component. Part 2 will cover the BlackSanta EDR-kil...
dll-sideloading
BlackSanta EDR Killer: Deep Dive into DWrite.dll (Part 1 — Loader Analysis)
Scope: This is Part 1 of the BlackSanta analysis series, focusing exclusively on the DWrite.dll loader component. Part 2 will cover the BlackSanta EDR-kil...
process-hollowing
BlackSanta EDR Killer: Deep Dive into DWrite.dll (Part 1 — Loader Analysis)
Scope: This is Part 1 of the BlackSanta analysis series, focusing exclusively on the DWrite.dll loader component. Part 2 will cover the BlackSanta EDR-kil...
interlock
Interlock Ransomware: Deep Dive into a C-Based FreeBSD Encryptor
Interlock Ransomware: Deep Dive into a C-Based FreeBSD Encryptor
freebsd
Interlock Ransomware: Deep Dive into a C-Based FreeBSD Encryptor
Interlock Ransomware: Deep Dive into a C-Based FreeBSD Encryptor
esxi
Interlock Ransomware: Deep Dive into a C-Based FreeBSD Encryptor
Interlock Ransomware: Deep Dive into a C-Based FreeBSD Encryptor
vect
VECT 2.0 Ransomware: Deep Dive into a C++ Windows Encryptor
VECT 2.0 Ransomware — Deep Dive Analysis
salsa20
VECT 2.0 Ransomware: Deep Dive into a C++ Windows Encryptor
VECT 2.0 Ransomware — Deep Dive Analysis
curve25519
VECT 2.0 Ransomware: Deep Dive into a C++ Windows Encryptor
VECT 2.0 Ransomware — Deep Dive Analysis
lateral-movement
VECT 2.0 Ransomware: Deep Dive into a C++ Windows Encryptor
VECT 2.0 Ransomware — Deep Dive Analysis
stealer
Remus Stealer: C2 Protocol Analysis, Cryptography, and Detection
Disclaimer: This blog and all associated research are part of my personal independent study. All hardware, software, and infrastructure are personally owned ...
remus
Remus Stealer: C2 Protocol Analysis, Cryptography, and Detection
Disclaimer: This blog and all associated research are part of my personal independent study. All hardware, software, and infrastructure are personally owned ...
lumma
Remus Stealer: C2 Protocol Analysis, Cryptography, and Detection
Disclaimer: This blog and all associated research are part of my personal independent study. All hardware, software, and infrastructure are personally owned ...
etherhiding
Remus Stealer: C2 Protocol Analysis, Cryptography, and Detection
Disclaimer: This blog and all associated research are part of my personal independent study. All hardware, software, and infrastructure are personally owned ...
c2-analysis
Remus Stealer: C2 Protocol Analysis, Cryptography, and Detection
Disclaimer: This blog and all associated research are part of my personal independent study. All hardware, software, and infrastructure are personally owned ...
x64dbg
Remus Stealer: C2 Protocol Analysis, Cryptography, and Detection
Disclaimer: This blog and all associated research are part of my personal independent study. All hardware, software, and infrastructure are personally owned ...
wireshark
Remus Stealer: C2 Protocol Analysis, Cryptography, and Detection
Disclaimer: This blog and all associated research are part of my personal independent study. All hardware, software, and infrastructure are personally owned ...
detection-engineering
Remus Stealer: C2 Protocol Analysis, Cryptography, and Detection
Disclaimer: This blog and all associated research are part of my personal independent study. All hardware, software, and infrastructure are personally owned ...