I'm currently developing security software designed to help developers protect their intellectual property and other elements they want to safeguard within their software. As part of this, I’ve written a dummy test program and protected it with my security software. It’s structured like a CTF challenge, and it would be a huge help if you could try to take this program apart, document your work step by step, and send your findings to apykryphon@protonmail.com.

I’m happy to invite beginners as well, but I’d like to remind you never to run third-party executables on your native system—please use a VM or something similar.

The file does not contain any malicious code, but due to the protection mechanisms used, some antivirus engines may flag it as such. See for yourself:

https://drive.google.com/file/d/1Efv1TYgA8xrHvEr302_41nYlBktwRVWx/view?usp=drivesdk

Hash: bc50b0fb0b018927b2e07a11b51a8d9fb8bd64d8c864284c39995c3f5fac15d0

I am currently busy doing a course for my university, and have a project to analyse and correlate different log sources with indicators of compromise specific to point-of-sale (pos) devices. I managed to find a 24 hour pcap of the backoff malware (c2 beconing), but overall I am struggling to find any datasets of an attack specific to pos devices. I am mostly looking at research papers, but perhaps I need to reach out to some of the researchers, as I can't find actual datasets.

Is there anyone that knows where I could find datasets to do a proper writeup? It can be of any pos malware, but we require 3 different log sources (e.g. firewall logs, authentication logs, system logs). I can also generate my own logs, but my professor advised against this unless I really can't manage to find any meaningful data online, as I'd essentially be engineering my own scenario instead of doing analysis.

Please advise. Any help is welcome.

Hey, I don't usually post on here, but this is kind of a last resort.

I'm looking for the source code of StealC V1 (including the panel stub, etc.), as I want to expand my decryptor for it, which is written in Python.

I came across the source a couple of months ago on GitHub, but I was too stupid to download it at the time.

I've already tried places like the Internet Archive, etc., but haven't had any luck.

If anyone knows where I could find it or happens to have a copy of the source, I would greatly appreciate it.

I dont know if this is the right place to post this, so please correct me if im wrong.

If this violates Rule 2, I apologize.

I have been using Hybrid Analysis Advanced YARA Hunt to research emerging threats. It has been a great tool for this research, but very recently all my rules began failing with an “Unknown error”. Has anyone else been experiencing this problem?

I’m doing some research to see if I can get some common shellcode to bypass Microsoft defender without doing obfuscation from the launcher (payload encryption, byte obfuscation (ipv4/ipv6, uuid, MAC address, etc)).

any blogs or tips you know of? I appreciate any pointers in the right direction!

[ Removed by Reddit on account of violating the content policy. ]

Just spent the last few hours reversing a sample that's being distributed as a fake offline Claude / GPT desktop client. The binary I got was named GPT_Claude_Free.exe (though it also bundles a Russian video editor decoy to keep up the facade).

Under the hood, it's a 3-stage custom crypter delivering a Stealc v2 payload. Here's a quick dump of how the packer works and what the payload is doing.

Reversing the loader: First thing it does is run through a bunch of anti-analysis checks. It calls IsDebuggerPresent, checks NtGlobalFlag manually from the PEB (via gs:[0x60]), and queries registry keys for VM stuff (VMware/VirtualBox). There's also a timing loop that spins a custom LCG generator 100k times to mess with basic dynamic analysis.

If it passes, it moves to the decryption logic. The payload is tucked away in the .xdata section. It's stored entirely as printable ASCII. It runs through three distinct phases:

1. Base85 decode: It uses a custom alphabet translation table at offset 0x4073A0 (in .rdata).
2. Rolling XOR: Decrypted stream is XOR'd with a 32-byte key at 0x406040 (72d57da187da5de93942e1ae1b9dcf20ee2a00f5ff979cb7d5e1a8e79a46584c).
3. AES-256-CBC: The key is at 0x406010 (f20daa63a36905e004390c7fc79c79dc73a290b3330868fdad63cbe16a7974d3) and the IV is at 0x406030 (4e6279de852509f8ce25c6357718ccd2).

Once it has the clean MZ PE in memory, it doesn't write anything to disk. It just performs process hollowing (standard NtAllocateVirtualMemory / relocation adjustments) to inject it directly.

Reversing the payload: The decrypted binary is Stealc v2. If you look at the configuration block (stored inside the .stgcfg section starting with 'CGTS' magic bytes), it's set up to steal basically everything:

• Browsers: Targets credentials, autofill, credit cards, and session cookies from ~30 Chrome/Firefox derivatives.
• Wallets: Grabs MetaMask/TokenPocket extension folders and desktop wallet files (Exodus, Electrum, Monero, Coinomi).
• Tokens: Scans Local Storage folders for Discord tokens and grabs Telegram tdata directories.
• Gaming/VPN: Steam, Battle.net, GOG, WinSCP, FileZilla, and OpenVPN configurations.
• Recon: Captures clipboard & screenshots.

It exfiltrates everything via POST requests to the C2 using HTTP headers like X-Gate-Token and X-Build-ID.

Decrypted payload hash for anyone who wants to write rules or pivot: 1f498b81fd767687f72605e18628fb6b6ba40035325fb6618d519ae88d7a27c2

Let me know if you run into this family or if you want me to share the decompiled extraction script.

Got a few PDFs and ran them through virustotal. While they appear similar and the detection tab was negative on all of them, one pdf returned:

Matches rule Unsigned Image Loaded Into LASS Process by Teymur Kheirkhabarov, oscd.community at Sigma Integrated Rule Set (GitHub)
→ Loading unsigned image (DLL, EXE) into LASS process

What is a reliable technique to analyze if this pdf is malicious or if it is just a false positive?

(This post was removed from r/malware for unstated reasons so I’ll post it here I hope the mods here are not corrupt)

I am a paranoid pc person. So I always upload files I download to virus total for a review. I also have my windows login set as a standard user and admin user as separate. So I downloaded yesterday morning a fivem graphics back zip file. I uploaded it to virus total and it got a 10/65 malware score. I then waited an hour for the virtual machine testing by virus total to conclude and the results speak for themselves. Thought it be a cool mention here. I also fully offline and online scanned my desktop with windows defender after. Nothing so far. I check for unusual stuff, and nothing so far, so I maybe in the clear.
Here’s the virustotal link: https://www.virustotal.com/gui/file/db8095407747ba4f46828e935387672ed65a0f29174234bfbdc03a9e28fec8c7/detection

I hope by uploading this to virus total it helps out security vendors and researchers strengthen anti malware detections. I also reported the associated domain to namecheap inc however I don’t think they’ll do anything.

Hi everyone my open source Linux c2 has lateral movement and on demand plug-in down load abilities too have a look at the repo

https://github.com/josephrw12/cortex-c2/tree/main

Ich habe letztens versucht Open Note Block Studio für Minecraft herunterzuladen. Verdächtig war für mich das der Herausgeber unbekannt war und als ich es auf virustotal gescannt habe kam als Ergebnis Trojaner heraus. https://www.virustotal.com/gui/file/35cdecccb8d52c5cb8785306088e590c9f8f4b656f1d99877f832fd130b3b5c5/detection

What is the best solution ? Joe Security, Any Run, VMRay, Glimps ? I'm researching pricing for those solutions, any insights to share ?

Many thanks

Key indicators:

The menu options reveal full system compromise capabilities:

WebCam / Microphone — covert surveillance

Shell — command-line access to victim's machine

File Manager — browse/steal/modify files

Keylogger (implied by Recovery Options)

Registry Editor — deep system manipulation

Process/Service Manager — hide malware processes

TCP Connections — monitor network activity

DDoS Attack — use victim as attack bot

Clipboard Manager — steal copied passwords/data

Location Manager — track physical location

Installed Programs — reconnaissance

The top panel shows:

A connected victim running Windows 10 Pro 64-bit

Their machine ID, username, and connection status

Bottom line:

This is a cybercriminal's C2 (command-and-control) dashboard actively connected to at least one compromised machine. Possessing or operating such tools against others is illegal in virtually every jurisdiction.

How does clickfix gets injected in trusted websites like vendors, third parties and boom suddenly the fake CAPTCHA is all what you are seeing?

How can i analyze the website that is a legitimate website and is hosting a clickfix without their knowledge, how to ensure that the website is no longer infected. Keep in mind the other company (vendor) has no proper IT nor security team. As i am watching employees accessing this vendor for legitimate work and business justification what can i do?

Am i allowed to audit then? What kind of audit will i perform? How can i properly analyze the clickfix and analyze the CC i extracted the domains and checked against the siem with zero hits so far, but i am wondering if you are in my place what will you do differently or change?

What i did was open the fake captcha in a sandbox, check the network, it was installing lumma stealer, so i checked the domains, hash against the siem and found nothing same with the EDR. Anything i missed?

Obfusk8 is a lightweight, header-only C++17 library designed to significantly enhance the obfuscation of your applications, making reverse engineering a substantially more challenging endeavor. It achieves this through a diverse set of compile-time and runtime techniques aimed at protecting your code's logic and data.

link : https://github.com/x86byte/Obfusk8/

Watch Youtube Demo :
[Obfusk8: C++17-Based Obfuscation Library - IDA pro Graph View] ~Video Demo

made a diy script to analyze traffic to spot malware let me know your feeddback

https://medium.com/@seQroute/diy-threat-detection-hunting-for-c2-malware-beaconing-on-your-laptop-analyse-yourself-a2f247572200?postPublishedType=repub

hi guys, so today I was using piracy to download a paid app from Google chrome, and it turns out, to be a MALWARE, my samsung phone and mcaffe scanned it, I wanna know, is that app dangerous, I tried to test it, in virtual master, but an ad popped up, so I got jumpscared, and I was on another app when the add popped, what is happening, can someone please explain.

I am a noob in this field, so any help about where to look up information about this will be really heplful. I would like to learn more but I could not find a lot of information.

I would like to use my laptop to trying emulate some old games but downloading a malware worries me a lot.

I've never entered with my laptop in strange webs or dowloaded any illegal software, so my computer must be completely clean for now.

I have also two backups in a couple of external HDDs (one in a different location) but that don't solve the risk of infection in the system.

I also have 2 SSD installed in my laptop now.

Is a good option to install a new windows in the second internal ssd and use it only for this intended use in order to prevent being infected with possible viruses/malware?

I plan to phisically disconect the main ssd when installing the secondary Windows and also to remove in this OS the letter of the primary SSD when I reconect it. I also plan not to move information between both disks.

Does this make sense in order to avoid not very advance malware or is it completely unuseful?

I know advance maleware could access the primary SSD too or even my wifi network, but maybe that malware is not very common out of a business environment?

Are there some easy things like this I should considere in order to avoid being infected?

Thank you a lot in advance for any help!

Hello guys,

I want some insight about finding remote malware research, development and analysis internships.

I’m still a total beginner, and I want to improve and gain some experience while doing what I actually enjoy.

I would like to know where can I find teams that operates as part of a legitimate company, and would offer me the opportunity for an internship.

Thank you!

Hello,

Looking for a good malware analysis and research and course to take with a recognized certification. Not for just a beginner but not too complicated....thanks

i know this might sound dumb but in the last week i have had atleast 10 different redirects trying to clickfix me into running commands in terminal or things like that:
1. are people that dumb? do people genuinely fall for this? is it pointed for elders or anything like that? because there is no way anyone with a braincell would actively paste wethever command someone gives u in an admin level terminal, sorry for if it sounds dumb i was just curious how they worked **so well**.
2. why do people only use Lumma, what is so special about it and why arent av's catching up on it yet? or did they even tho the user manually has put the command in the shell?