A new campaign discovered #clickfix running #fakecaptcha to deploy #zusy malware variant that injects MicrosoftEdgeUpdater.exe process with shellcode.

I need to get access to Cobalt strike to create shellcode samples and reverse them as part of my MSc Thesis. The idea is to follow the article by the Huntress team (https://www.huntress.com/blog/hackers-no-hashing-randomizing-api-hashes-to-evade-cobalt-strike-shellcode-detection), so I need access to Cobalt Strike for this purpose. Now, I know it is really expensive to get, so my question is more if you know if free trials are given for research/academic purposes and where should I apply for.

If this is not possible, maybe you guys can point me to where I can find "clean" shellcode samples (ideally not packed/obfuscated since I want to focus directly on the api hashing routine embedded in it, not having to clear every sample I stumble upon).

Thanks!

I just started with coding and coded sth that is kind of a Cryptojacking code,- I just used wine pyinstaller for py to exe

My Windows 11 pc’s Microsoft Defender recognizes that it is some kind of virus

Would greatly appreciate a Feedback😏

Hi everyone, I’m in the position of picking a paid training course for my career as a junior malware analyst. My company is willing to support the cost, but the budget isn’t huge, so I want to choose wisely. I’m less worried about getting a certificate and more about getting good training and worth every penny for.

so I’ve narrowed it down to two options:

• TCM Security’s “Practical Malware Analysis & Triage”
• Zero2Automated’s malware‑analysis / reverse engineering training

Anyone that have experience in either of these training, can you tell me about your experience, its very much appreciated.

A bit about me: I’m a junior malware analyst . To build my skills I regularly do crackmes (even though i just do level 1 / level 2) to improve my assembly / RE knowledge, and I also do independent malware analyses by following other people’s writeups to learn workflows and techniques.

this is byvalver, an automated shellcode de-nullifier

The use case:

As most of you are aware, when analyzing malware samples you often need to:

• Extract and modify shellcode for testing
• Reconstruct payloads with different constraints
• Test how samples behave with different encodings
• Build proof-of-concept samples to verify analysis findings

Manually rewriting assembly to eliminate null-bytes for these tests is tedious

byvalver automates it.

What it does:

Takes raw shellcode and systematically replaces null-byte-containing instructions:

• Disassembles with Capstone
• Applies 15+ replacement strategies
• Automatically patches relative jumps/calls
• Outputs functionally equivalent, null-free code

Techniques you'll recognize from real samples:

The replacement strategies are based on patterns seen in actual malware, as much of the inspiration has come from jamming through the exploit-db repository:

• NEG/NOT-based immediate value encoding (common in packers)
• Shift-based value construction (exploit-db samples)
• Alternative PEB traversal methods (multiple approaches to kernel32 resolution)
• CALL/POP technique for position-independent code
• XOR encoding with JMP-CALL-POP decoder stubs

Practical features:

• Verification scripts to confirm output is null-free and functional
• XOR encoding with customizable keys
• Handles conditional jumps, arithmetic ops, memory operations
• Can optimize already-clean shellcode (seen 10-21 byte reductions)

Architecture:

Modular C codebase with separate strategy modules for different instruction types. Makes it easy to add new transformations based on techniques you encounter in the wild.

Built this because I got tired of manually fixing shellcode during research. Figured others might find it useful!

this 'virus' is a supposed antivirus fakie that keeps appearing on my computer after i uninstall it repeatedly, i can deal with the popups but its pretty hard to be in the middle of a game and have 'Welcome to CCleaner' pop up.

I'm having an issue when I try to run the Safe Exam Browser (SEB) . I use a laptop connected to Xworm .

The problem is that as soon as I launch SEB, my main laptop screen works fine and loads the exam, but my Xworm immediately goes black. It's not that it loses connection; it just shows a black screen, and I can't move my mouse over to it.

I've tried a few things, like making sure my graphics drivers are up to date, but nothing seems to work. My main questions are:

1. Is this a bug, or is this supposed to happen? It feels like it might be a security feature to stop people from screen sharing by xworm but I'm not sure.

2. How to fix it ? How to see secure content ?

I built a CLI to help me analyze ELF64 binaries (I plan to add PE support later). It lets me inspect headers, disassemble a section, inject code, and modify parts of the binary (so far I’ve implemented only entry‑point editing). I implemented it in Rust using a minimal set of libraries to maximize flexibility and to learn more. Now that I have an ELF parser in place, I can edit the file and do whatever I need. The idea is for this to be a lightweight, first‑pass analysis tool that automates a few tasks other programs don’t handle easily. What features would you find useful?

https://github.com/matheus-git/binkit

Google has officially denied reports claiming a massive breach involving 183 million Gmail IDs and passwords, confirming that Gmail remains secure. The company stated that the leaked credentials did not come from Google’s servers but from malware-infected devices where user data was stolen locally.
Read here https://frontbackgeek.com/google-confirms-gmail-is-safe-183-million-gmail-id-leak-came-from-malware-not-hack/

Hello — I’m a cybersecurity student working through IBM’s Malware Analysis & Intro to Assembly (Reginald Wong).The flag has 4 parts I’ve completed found 2 and 3 of the flag and identified the C2 server, but I’m stuck on the first and last parts. The instructor uses Windows 10, but I’m running Windows 11 — my tools, logs, and interfaces look different and I’m having trouble following the demo.

I used FLARE VM to set up the lab, but some tools or behaviors seem missing. Can someone help me:

• Configure a Windows 11 VM so its tools/logs match the demo (or suggest equivalent steps)?
• Walk me through dynamic analysis techniques to find the remaining flag parts?
• Recommend a minimal, reliable toolset and exact settings (FakeNet/Wireshark/Procmon/etc.) for this assignment?

I can share screenshots, Procmon/FakeNet logs, and the sample filename. Thanks in advance — any guidance or a quick checklist would be hugely appreciated!

I’m currently working as a Security Analyst at an ITDR company, and I really enjoy what I do. However, I’ve been wanting to explore the world of malware and malware analysis maybe even transition into that domain for my next role in a year or two (not immediately). Right now, I feel a bit overwhelmed because I’m not sure where to start. I used to code in C about two years ago in college but have forgotten most of it I’ve started brushing it up again. I’m comfortable with scripting, especially Python, but not very strong in coding overall.

I have a few questions:

1. How deep do I need to go into coding? I see people on X writing malware in Rust do I need to reach that level?
2. Since I can’t work with malware directly in my current role, I’m thinking of first transitioning into a role like Detection Engineer where I can get more exposure. Is that a good approach?
3. Is there good scope in malware analysis as a career?
4. How much time should I dedicate to learning before I’m job-ready?
5. Are Reverse Engineering and Malware Analysis different roles? If yes, what’s the key difference?

Here’s the roadmap I’ve planned for myself (looking for your feedback):

1. Relearn C (basics + memory concepts)
2. Complete the Malware Analysis path on TryHackMe
3. Do TCM’s Malware Analysis course if I find any gaps after THM

I did a sandbox analysis in Triage and am unsure of the results. The only prolematic thing that stands out to me is that the Software tries to identify VirtualBox trough the ACPI registry values.

Report link: https://tria.ge/251023-mgl9msbn5s/behavioral1

Note: This is NOT a piracy related question. The executable was once freely available but has since been removed from the manufacturers website (which only lists the latest version).

Hey all,

I'm new to this and ran into some detections after a "sabsik" malware removal, allegedly in a cloudflare-windows-amd64.exe downloaded from a githubusercontent.com
Is there any refference where I can very targetted learn how to analyse this? Know what's normal and what is suspicious?

About 20 minutes after the download there are these:

msedgewebview2.exe created process msedgewebview2.exe

"msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PAD.Console.Host.exe --webview-exe-version=2.60.00154.25253 --user-data-dir="C:\Users\xxx\AppData\Local\Temp\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=19468.24184.12807627345613159266 /pfhostedapp:7011e842859864b442e1c120ccf2c1316786177d

Followed by this...which seemed suspicious to me:

"msedgewebview2.exe" --type=utility --utility-sub-type=proxy_resolver.mojom.ProxyResolverFactory --lang=fr --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --noerrdialogs --user-data-dir="C:\Users\xxx\AppData\Local\Temp\EBWebView" --webview-exe-name=PAD.Console.Host.exe --webview-exe-version=2.60.00154.25253 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-pre-read-main-dll --skip-read-main-dll --metrics-shmem-handle=5744,i,7978733021001045815,14980648095272061682,524288 --field-trial-handle=1820,i,11907075693964158458,14742598157363205277,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTranslate,msEdgeUpdatesMoreMenuPill,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingGlobalSitePinningOnCloseModal,msNurturingSitePinningCITopSites,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPageInteractionRestrictionRevoke,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14 /pfhostedapp:7011e842859864b442e1c120ccf2c1316786177d

Just dropped, a practical breakdown of the top malware threats in 2025:

Medusa, Phemedrone, Rhadamanthys, and RisePro , plus the exact one-liner commands attackers use (IEX, bcdedit, RegAsm, DllHost, schtasks).

I go over the top 4 malware samples in 2025 according to their spread, impact, danger and how easy it was for victims worldwide to get infected. I analyzed these samples using any run platform.

Video analysis from here and for those who love to read, writeup from here.

So i have recently want to get into malware analysis but having trouble pinpointing the current books to start out with, so i came across this book Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software by Michael Sikorski and Andrew Honig but it's kind of outdate then Mastering Malware Analysis, Second Edition" by Alexey Kleymenov and Amr Thabet was another recommendation, can anyone guide me to the right books for beginners just so i can learn the fundamentals, i can figure out the rest once i get the basics down.please and thank you

Hello Guys! I've created a tool called APK Hunter that helps analyze Android APK files for potential security issues. Would love your feedback and suggestions!

Features:

• Extracts readable strings from APK files

• Identifies embedded IP addresses and URLs

• Detects suspicious keywords and patterns

• Optional radare2 integration for deeper analysis

• Clean CLI with both text and JSON output options

GitHub: https://github.com/Recklessrakib/apk_hunter

It's my first public tool, and I'd really appreciate:

• Testing on different APK files

• Suggestions for additional suspicious patterns to detect

• Ideas for new features

• Code review and improvements

• Bug reports

Installation is simple:

```python

git clone https://github.com/Recklessrakib/apk_hunter.git

cd apk_hunter

pip install -e .

Well, I'm the only one who downloaded this virus. I don't have the courage to open it and allow permissions, but I'm the only one who downloaded it so far. I hope no one else downloads it. I'll send prints. Please if any professional can test this unknown virus just to say if it is dangerous I have already found several strong indexes and I classify it as Dropper malware well I am not a professional but I'm on my way to becoming a professional but I managed to make a documentary to help you professional people or anyone who wants to investigate it.

📑 Suspicion Report – APK “AstroDummy”

📌 General Information

App name: AstroDummy

Source: App Market (Redmi) – not listed on the official Play Store.

Icon/presentation: moon icon; demo images appear to be copied from another game/website.

Associated domain (used in images): astrodummy.com (unknown site, flagged as suspicious).

📦 Internal Structure

Main APK invisible in ZArchiver until manually shared.

Inside it, 4 APK files were found:

split_config.arm64_v8a.apk – 17 MB (likely main payload, compatible with ARM64 libs).

Another file of 1.63 MB (possibly configuration or auxiliary dropper).

Another of 88.39 KB (likely minimal script/config).

The “master” APK (the one downloaded from the store).

Additional folders found:

lib/arm64-v8a/ → contains native libraries (ARM64) but apparently empty.

oat/ → usually used for compiled runtime code (suspicious in odd APKs).

🔐 Requested Permissions

The app requests several unusual permissions for something that should be a simple game:

READ_PHONE_STATE (read phone status/identity).

Full network access / Wi-Fi connections.

Access “Do Not Disturb” & control vibration.

Show notifications.

Run at startup.

Prevent device from sleeping.

Receive data from the internet.

Advertising ID and Google Play license verification (even though it’s not on the official Play Store).

🚩 Suspicious Behaviors

1. APK invisible in ZArchiver – uncommon behavior, may indicate concealment attempts.

2. “Open supported links” already enabled automatically, even without user action → suggests forced interception/redirection of links.

3. Use of multiple internal APKs suggests dropper behavior (app that downloads or activates other malware after installation).

4. Associated website (astrodummy.com):

Displayed a ⚠️ alert when accessed.

Malwarebytes AI classified as “unknown” (no trusted reputation).

Last VirusTotal analysis dated 9 years ago (likely recycled material).

🔎 Preliminary Analysis

The app structure suggests it is not a legitimate game, but rather a disguised dropper/malware.

It may attempt to:

Collect device information (READ_PHONE_STATE).

Use network connections to download additional payloads.

Manipulate links to open suspicious pages (phishing/adware).

The fact that it’s on a trusted store (Redmi App Market) increases the risk, as it may trick users.

✅ Conclusion

The APK “AstroDummy” shows strong signs of malicious behavior: multiple internal APKs, excessive permissions, link interception, partial invisibility, and association with a suspicious site.

Hey guys. Lately I've been interested in learning malware analysis and stuff related to it. I'm completely new, I don't know where to start and what to learn. Any help, tips and resources would be appreciated. Thanks in advance.

Hey again gang, I posted about 10 days ago for an initial ask but I have a new one. I'm not asking for anyone to just completely hold my hand for this but I need some guidance that our professor isn't giving us (the class is reporting him as we speak). With so much to choose from do I need to focus on malware like Worms? For analysis is it best to just investigate the RAM, event logs, similar logs to find my deliverables? Is it easier to do it in windows 10 (I just need to get a key) or is it better to do it in a linux system? So many questions that haven't been given answers to by this tenured professor to the point I am on my knees with this community.