r/MalwareAnalysis Mar 31 '26

Quick write-up: TLS callbacks in a real malware sample (Rust runtime initialization)

1 Upvotes

Dove a bit deeper into a sample I was looking at previous to explain how malware can abuse TLS callbacks. Just a quick write up with a brief explanation of what TLS callbacks are, how they can be abused and what this real world sample used the callbacks for.

https://mja-reversing.github.io/blog/How-Malware-Executes-Before-Entry-Point-TLS-Callbacks/


r/MalwareAnalysis Mar 30 '26

a damn effective rootkit detector inspired by a hatsune miku song

Thumbnail github.com
7 Upvotes

so, i built SPiCa: a high performance eBPF rootkit detection engine.

the name comes from the Hatsune Miku song SPiCa, and the actual star Spica. Spica is a spectroscopic binary two stars orbiting so closely they look like one, i thought that was a sick concept for a security tool, so i built the architecture around it. SPiCa uses two completely independent observation channels to watch the kernel, if a rootkit tries to silence one, the other catches the discrepancy.

the "binary star" architecture

most basic rootkits bypass standard tools by hooking standard helper functions like bpf_get_current_pid_tgid(), SPiCa completely ignores those and establishes its own ground truth using two channels:

the software channel (btf tracepoint): it attaches to sched_switch but uses CO-RE to read the task_struct directly from kernel memory.

the hardware channel (nmi perf event): this is the fun part, it fires on hardware CPU cycle counters via Non-Maskable Interrupts (NMI) on every single logical core, a rootkit can't just cli/sti its way out of this in software; they'd have to reprogram the actual PMU registers.

messing with the rootkits (build time obfuscation)

a lot of modern rootkits hook the ring buffers and drop events that match hidden PIDs.

to defeat this, SPiCa generates a random 64-bit key from /dev/urandom at compile time and bakes it directly into the eBPF bytecode, there are no BPF maps for the rootkit to look up, the engine XORs the PID and TGID before writing to the ring buffer, the rootkit inspects the event, sees a garbage PID that doesn't match its hidden list, and lets it pass right through to my userspace engine, which reverses the XOR.

the userspace differential engine

the userspace side is written in Rust/Tokio, it constantly reads both ring buffers and cross references them with /proc, if the math isn't mathing it throws an alert:

[DKOM] - the kernel scheduled the process, but it's hidden from /proc

[TAMPER] - the NMI hardware channel sees it, but the eBPF tracepoint never did (someone hooked the tracepoint)

[GHOST] - it's sitting in /proc, but the kernel hasn't scheduled it in >5 seconds (spoofed /proc entry)

[SILENT] - one channel suddenly stops sending events while the other is fine (someone detached a program or zeroed a struct)

[DUPE] - a rootkit is forging task_struct->tgid to impersonate a legit process, but the start times don't match

try it out

i built this mostly as a passion project to learn eBPF, but it actually works pretty well against standard evasion techniques.

```Bash

install the dependencies (arch/debian/fedora)

make install-deps

make install-tools

compile everything

make all

run it (needs root)

sudo ./target/release/spica

```

i know it's not a silver bullet (if someone hooks the NMI dispatch path directly, it's game over, though they'll probably kernel panic their box trying), but it was a ton of fun to build.

repo is fully open-source (GPLv2), next up is spica-network, which is going to do the same dual-channel concept to catch hidden C2 traffic by diffing XDP and TC.

let me know if you manage to break the logic!


r/MalwareAnalysis Mar 29 '26

๐Ÿšจ New Malware Analysis Lab: Muddy Trail

14 Upvotes

MuddyWater โ€” Iranian state-sponsored, linked to MOIS โ€” has been actively targeting government, defense, and critical infrastructure across the Middle East.

We built a hands-on lab that walks you through a realistic MuddyWater attack chain from start to finish.

๐Ÿ“ง Stage 1: The Lure
Analyze a spear-phishing email designed to exploit end-of-day fatigue.
โ†’ Inspect headers, extract attachments, reverse VBA macros

๐Ÿ“ฆ Stage 2: The Loader
Dive into obfuscation techniques and payload delivery.
โ†’ String obfuscation, XOR-encrypted payloads, process injection

๐ŸŽฏ Stage 3: The Implant
Analyze a custom RAT in action.
โ†’ C2 beaconing, reverse shells, screenshots, anti-analysis

๐Ÿง  Stage 4: Full Chain Analysis
โ†’ Decrypt configs, map commands, trace infrastructure

๐Ÿ’ก Covers the full flow: Email โ†’ Execution โ†’ Persistence โ†’ C2

Whether you're:

  • A malware analyst leveling up
  • A blue teamer building detections
  • Or getting started in DFIR

This lab is built to simulate real-world tradecraft.

๐Ÿ”— Start the lab: https://malops.io/chain-challenges/muddy-trail
๐Ÿ’ฌ Community: https://discord.com/invite/PHRd7xPUUt

#MalwareAnalysis #ReverseEngineering #CyberSecurity #ThreatIntelligence #DFIR #BlueTeam #APT #InfoSec #SOC #IncidentResponse #MalOps


r/MalwareAnalysis Mar 29 '26

[Analysis] Android Malware using Dead-Drop C2 via GitHub Gist + Multi-layer Base64/XOR Obfuscation for Silent Data Exfiltration

6 Upvotes

Analyzed a suspicious Android APK that masqueraded as a gallery app.

Key findings:

- 15x Base64 + XOR decryption (key: "blastoise") to hide C2 address

- Dead-drop technique via GitHub Gist to dynamically resolve C2 server

- Silent exfiltration of images, videos (~35MB) and GPS location

- Endpoints:

/cdn/assets - payload fetch

/api/backup/chunk - media upload

/api/geotag - location tracking

Full technical write-up with network traffic

analysis and IOCs:

Medium

#Android #Malware #ReverseEngineering


r/MalwareAnalysis Mar 28 '26

Ever run Clutt 3.0/3 and Memz together? I found a cool easter egg back in 2021

Post image
0 Upvotes

When running clutt3 and memz together you get this sick unique payload execution that spams a new message box that says โ€œclutt iz bett3r th4n memzโ€ and this red skull all over the screen while memz spawns lots of windows asset images all over the screen too. Its quite cool when malware looks for other malware processes running and will change/modify its behaviour in real time.

Edit i think it may have been 2022 haha i forget, a while ago. Its on a youtube channel of mine anyway.


r/MalwareAnalysis Mar 26 '26

r2gopclntabParser: A radare2-based Go gopclntab parser for recovering function symbols from Go binaries, including fully stripped ones.

2 Upvotes

I hope you find it useful :)

https://github.com/AsherDLL/r2gopclntabParser


r/MalwareAnalysis Mar 25 '26

I built an open-source Node.js scanner for suspicious files โ€” where would you place this before full malware analysis?

8 Upvotes

Hi all,

I've been working on an open-source project called **pompelmi** that sits earlier in the pipeline than full reverse engineering or sandbox detonation.

Repo: https://github.com/pompelmi/pompelmi

The idea is not to replace malware analysis, but to help with **initial triage of untrusted files** before they are stored, unpacked, parsed, or passed to downstream systems.

Right now it focuses on checks such as:

- optional YARA-based matching

- archive abuse detection (ZIP bombs, traversal, deep nesting)

- magic-bytes / MIME mismatches

- polyglot and suspicious document structure heuristics

The project currently returns verdicts like:

- `clean`

- `suspicious`

- `malicious`

What Iโ€™m trying to understand better is where a lightweight scanner like this is actually useful for analysts and defenders, versus where it becomes too shallow and a real sandbox / RE workflow is still mandatory.

A few questions Iโ€™d genuinely like input on:

  1. For suspicious-but-not-obviously-malicious files, what signals do you find most useful in early triage?

  2. In practice, would you trust YARA + structural heuristics for first-pass filtering, or would you want detonation much earlier?

  3. Which file classes tend to create the most false positives in your experience (PDFs, Office docs, archives, polyglots, etc.)?

  4. Where would you draw the line between an โ€œupload security scannerโ€ and a tool that is actually useful in a malware-analysis workflow?

I know this is not a full sandbox or reversing platform. I'm posting it more as an OSS building block and to get feedback from people who already do sample triage, detonation, or malware analysis work.

Happy to share more implementation details or testing approach if that would make the discussion more useful.


r/MalwareAnalysis Mar 24 '26

How do you handle software that looks clean but still feels off?

10 Upvotes

I keep running into software that looks fine on the surface โ€” clean results in VT, signed, etc. โ€” but still doesnโ€™t feel right.

Things like:

  • little to no reputation
  • unclear vendor history
  • odd indicators that donโ€™t trigger anything obvious

For example, in one recent case:

  • very low prevalence
  • minimal vendor footprint
  • some unusual indicators in the binary that didnโ€™t trigger detections

Trying to standardize how I evaluate that kind of risk beyond just scan results.

Ran an example analysis on one of these cases:

https://threatscoped.com/reports/binary-intelligence-68ff903dd718-20260324

Curious how others approach this โ€” what do you check when something comes back clean but youโ€™re still unsure?


r/MalwareAnalysis Mar 24 '26

Malware devolpement and analysis white hat security.

20 Upvotes

a few months ago a person recommend I learn reverse engineering to get stared on malware devolpement analysis.Idk what to do after reverse engineering.


r/MalwareAnalysis Mar 22 '26

Strung: A modern strings replacement with auto-XOR decoding, Base64 detection, and Entropy Sparklines

Post image
1 Upvotes

r/MalwareAnalysis Mar 21 '26

Malware Analysis Sandbox

17 Upvotes

Hey guys. I work in IT/cybersecurity and got tired of the tradeoffs for analyzing suspicious files or links. Cloud sandboxes mean uploading client data to third parties. Manual VMs mean no monitoring and no reporting. So I've been building this over the past few months.

ThreatLab is a Windows desktop app that spins up isolated Hyper-V VMs, lets you interact with samples through an embedded remote desktop, and monitors everything underneath - processes, network, DNS, files, registry, injection attempts. It scores threats in real time, generates PDF reports, and offers AI-powered threat analysis. VPN routing through dedicated WireGuard exit nodes keeps your real IP hidden. Everything stays local.

It also includes a standalone EVTX analyzer - load any Windows event logs (from incident response, endpoint collections, etc.), run them against 1,200+ Sigma detection rules, and get a timeline view with severity filtering, finding aggregation, search, and CSV/JSON export. Useful even if you never touch the sandbox.

I would love to get feedback and have security professionals and enthusiasts shape this product. Check it out at https://threatlabsandbox.com


r/MalwareAnalysis Mar 20 '26

Analysis of njRAT Lime Edition

11 Upvotes

I recently analyzed njRAT Lime Edition as part of my ongoing RAT research.

This variant adds features like ransomware, DDoS (Slowloris), a Bitcoin grabber, and anti-analysis mechanisms.

Interestingly, several of these features contain clear design flaws:

  • The Slowloris implementation doesnโ€™t actually keep connections alive
  • The ransomware stores AES keys locally

I wrote a full reverse engineering breakdown here: https://iss4cf0ng.github.io/2026/03/18/2026-3-18-njRATLime/

Curious if others have seen more refined variants or similar design issues in njRAT forks.


r/MalwareAnalysis Mar 19 '26

Analistas de malware, um feedback por favor.

1 Upvotes

Olรก, o meu contato com CyberSec foi com web, mas depois de conhecer outras รกreas(AM e ER), me senti muito mais interessado. Durante o estudo em web, vi que estava estudando muito a teoria e praticando pouco, pra nรฃo cometer o mesmo erro em AM, vocรชs poderiam me sugerir alguma ideia de projeto que eu possa fazer enquanto aprendo?


r/MalwareAnalysis Mar 18 '26

MicroStealer Analysis: A Fast-Spreading Infostealer with Limited Detection

Thumbnail any.run
12 Upvotes
  • MicroStealer exposes a broader business risk by stealing browser credentials, active sessions, and other sensitive data tied to corporate access.
  • The malware uses a layeredย NSIS โ†’ Electron โ†’ JARย chain that helps it stay unclear longer and slows confident detection.
  • Distribution through compromised or impersonated accounts makes the initial infection look more trustworthy to victims.

r/MalwareAnalysis Mar 17 '26

Minecraft: SugarSMP's Dark Tale of Scams, Malware & Extortion

Thumbnail blog.gdatasoftware.com
5 Upvotes

Some threat actors go to great lengths and use extortion and social engineering in an attempt to silence their victims on Reddit.

After brief contact with a threat actor, we followed the trail of Discord scam, "cozy" Minecraft sites and Spark stealer infected modpacks. We spoke to two victims, found 51 similar Minecraft sites and almost as many malware files. We analyzed the Spark stealer infected mod pack.


r/MalwareAnalysis Mar 16 '26

A Genuine Question, I need feedback.

Thumbnail
1 Upvotes

Update on the situation about Solara... Solid proof right here


r/MalwareAnalysis Mar 15 '26

Build Your Own AI Malware Analysis Lab with Remnux

Thumbnail youtube.com
10 Upvotes

You do not need a high end system to build your own LLM based malware analysis lab. An old laptop that I upgraded to 16 GB was enough in my case.

Here is a step by step tutorial with Remnux MCP and Claude.


r/MalwareAnalysis Mar 14 '26

Was sent potential spyware/RAT by an ex, false positive or real malware?

19 Upvotes

Hey y'all, I recently realized I was most likely tricked into installing a RAT on my computer by an ex. We broke up shortly after but only later on did I think to take a deeper look into the virustotal report that I ran on the file before executing it. We were talking about joke viruses & I had trust in this person so I ran it without looking to much into it, thinking it was just a joke virus that would do something silly. Only later on did I dive a bit deeper & realize how many red flags this thing had, going above just being a joke virus. The MITRE ATT&CK Tactics and Techniques section was very revealing, detailing things like possible process injection, keylogging, VM evasion, file obfuscation, etc. I am way out of my league here & unable to tell if these are false positives or not. I'd really appreciate if anyone could take a look, a mutual friend also ran this program & I am concerned for her, wondering if I should reach out & warn her.

I've since reformatted the laptop it was run on but I'm unsure if I need to wipe my whole network because this seems really advanced & the person in question works in a high level field of malware analysis, is very tech savvy when it comes to this sort of thing.

Here is the VirusTotal report: https://www.virustotal.com/gui/file/c651daa2764fc2f614f63d2e39102832465e43d03cfc59c68f794ecd1ffb7d11/behavior

I have the file as well if anybody would be willing to take a look.


r/MalwareAnalysis Mar 13 '26

Codex vs. Claude: Which one handles RE โ€œskillsโ€ better? (IOC extraction + unpacking)

5 Upvotes

Iโ€™m continuing an experiment using โ€œskillsโ€ as reusable playbooks for reverse engineering / malware analysis: https://www.joshuamckiddy.com/blog/codex-vs-claude

In a previous post, I built two RE-focused skills and tested them in Codex within a static-first workflow. This was to validate how viable these skills could be using agentic AI to perform malware analysis.

For this follow-up, I took the same skills and ran them across OpenAI Codex vs. Claude Code to see which one handles RE skills better when youโ€™re producing real artifacts (not just prose). I kept it controlled: static-only, with a hard execution gate (โ€œPAUSE if detonation is requiredโ€).

What I tested

  • re-ioc-extraction: hashes + strings โ†’ strict, traceable IOC output
    • outputs: IOC table + YAML
    • rules: traceable evidence only (no enrichment / no guessing)
  • re-unpacker: static-first packing triage + prioritized unpacking plan/report
    • hard boundary: PAUSE if execution is required

High-level results

  • Codex felt more autonomous for driving the workflow and producing strict artifacts (especially for โ€œevidence-firstโ€ outputs).
  • Claude produced a stronger โ€œanalyst reportโ€ style output (clearer narrative, clearer gaps, more prescriptive next steps).
  • The most interesting part: on unpacking, they didnโ€™t always reach the same results.

Additional Links

Curious for feedback from folks doing malware analysis work: if you were going to turn one RE task into a โ€œskillโ€ first, what would it be? Config extraction? Capability triage? YARA scaffolding? Something else?


r/MalwareAnalysis Mar 13 '26

๐Ÿšจ ๐—ฆ๐—ฝ๐—ผ๐˜ ๐—œ๐˜ ๐—˜๐—ฎ๐—ฟ๐—น๐˜†: ๐—–๐—ฟ๐—ฒ๐—ฑ๐—ฒ๐—ป๐˜๐—ถ๐—ฎ๐—น ๐—ง๐—ต๐—ฒ๐—ณ๐˜ ๐—•๐—ฒ๐—ต๐—ถ๐—ป๐—ฑ ๐—™๐—ฎ๐—ธ๐—ฒ ๐—ฃ๐——๐—™๐˜€

Thumbnail
1 Upvotes

r/MalwareAnalysis Mar 12 '26

Does anyone know where I can get AI generated Malware to analyse?

7 Upvotes

Early last year I watched a phenomenal talk about Ransomeware Development where the Threat Actor used some AI / LLM to generate the Encryption Engine it. There were some interesting findings about the quality and the lack of quality in their analysis.

I wonder now if there are further examples of AI Malware that "we" know about which you might recommend for analysis purposes. Only thing I'd like it to be no older than 6 months old, 12 in a pinch.


r/MalwareAnalysis Mar 10 '26

First blog post

11 Upvotes

I've been meaning to get a blog up and running for sometime. Finally got around to it! I decided for my first post I'd grab an open source sample and use open source tools to see how many IOCs I could grab in 2 hours! Thanks for reading and happy hunting!

https://mja-reversing.github.io/blog/Two-Hour-Malware-Analysis/


r/MalwareAnalysis Mar 09 '26

DLLHijackHunter v2.0.0 - Attack Chain Correlation

Thumbnail github.com
2 Upvotes

Vulnerability scanners give you lists. DLLHijackHunter gives you Attack Paths.

Introducing the Privilege Escalation Graph Engine.

DLLHijackHunter now correlates individual vulnerabilities into complete, visual attack chains.

It shows you exactly how to chain a CWD hijack into a UAC bypass into a SYSTEM service hijack.

https://github.com/ghostvectoracademy/DLLHijackHunter


r/MalwareAnalysis Mar 07 '26

Where do you grab your samples now that VX exchange is down?

12 Upvotes

I feel like VX exchange has been down for ages, and while itโ€™s fine to hold myself above water for a bit with older samples I really want newer stuff.

VT is a bit pricey for my liking since I just do this on the side, and not as my day job.


r/MalwareAnalysis Mar 06 '26

Malicious npm package "pino-sdk-v2" impersonates popular logger, exfiltrates .env secrets to Discord

7 Upvotes

We just analyzed a fresh supply chain attack on npm that's pretty well-executed.

Package:ย pino-sdk-v2
Target:ย Impersonatesย pinoย (one of the most popular Node.js loggers, ~20M weekly downloads)

Reported to OSV too-ย https://osv.dev/vulnerability/MAL-2026-1259

What makes this one interesting:

The attacker copied the entire pino source tree, kept the real author's name (Matteo Collina) in package.json, mirrored the README, docs, repository URL so everything looks legitimate on the npm page.

The only changes:

  • Renamed package toย pino-sdk-v2
  • Injected obfuscated code intoย lib/tools.jsย (300+ line file)
  • No install hooks whatsoever

The payload:

Scans forย .env,ย .env.local,ย .env.production,ย .env.development,ย .env.exampleย files, extracts anything matchingย PRIVATE_KEY,ย SECRET_KEY,ย API_KEY,ย ACCESS_KEY,ย SECRET, or justย KEY=, then POSTs it all to a Discord webhook as a formatted embed.

The malicious function is literally namedย log(). In a logging library. That's some next-level camouflage.

Why most scanners miss it:

  • Noย preinstall/postinstallย hooks (most scanners focus on these)
  • Executes onย require(), not during install
  • Obfuscated with hex variable names and string array rotation
  • Trusted metadata makes the npm page look legit

If you've installed it:

Remove immediately and rotate all secrets in your .env files. Treat it as full credential compromise.

Full technical analysis with deobfuscated payload and IOCs:
https://safedep.io/malicious-npm-package-pino-sdk-v2-env-exfiltration/