https://taogoldi.github.io/reverse-engineer/ Public malware reversing write-ups, unpacking workflows, and reproducible analysis artifacts. 2026-09-01T19:23:04-04:00 Tao Goldi https://taogoldi.github.io/reverse-engineer/ Jekyll © 2026 Tao Goldi /reverse-engineer/assets/img/favicons/favicon.ico /reverse-engineer/assets/img/favicons/favicon-96x96.png 2026-08-31T20:00:00-04:00 2026-08-31T20:00:00-04:00 https://taogoldi.github.io/reverse-engineer/blog/animateclipper-nativeaot-loader/ Tao Goldi

A NativeAOT stage-1 loader that dnSpy and ILSpy cannot read, taken apart statically: two hand-rolled keystream ciphers over its API name table, a CMSTPLUA elevation-moniker UAC bypass, a self-copy into Startup, and a full manual PE loader that hollows a signed Microsoft binary. Includes the recovered stage-2 cipher, its static 256-bit key and nonce, five YARA rules measured against 2,977 corpus samples, and the retrohunt that pushed the family's first observed build back ten weeks.

2026-06-24T20:00:00-04:00 2026-06-24T20:00:00-04:00 https://taogoldi.github.io/reverse-engineer/blog/violetrat-v6-winrar-vbnet-rat/ Tao Goldi

Static teardown of VioletRAT v6 (VioletWorm), a VB.NET commodity RAT misclassified as AsyncRAT. Recovers the Base64+XOR string layer, the AES-128-ECB C2 protocol, embedded C2 195.63.145[.]169:7000, the ~110-command dispatcher, and an in-memory AMSI bypass. Ships an offline decoder, a capture-only C2 client, and four YARA rules.

2026-05-18T20:00:00-04:00 2026-05-18T20:00:00-04:00 https://taogoldi.github.io/reverse-engineer/blog/studiosecghost-hvnc-browser-piggyback/ Tao Goldi

Full static teardown of StudioSecGhost, a novel native x64 hVNC agent that piggybacks on Chrome/Edge/Firefox via per-window ghost cloaking, skipping CreateDesktopW entirely. C2: 2.26.122[.]211:4444. Pure disassembly, no sandbox required.

2026-05-07T20:00:00-04:00 2026-05-07T20:00:00-04:00 https://taogoldi.github.io/reverse-engineer/blog/poolparty-itw-2026/ Tao Goldi

Three real-world PoolParty samples reverse-engineered end to end. Sample A is a 50 KB TP_DIRECT dropper that incidentally defeats capa's nursery TP_WORK rule; Sample B is the canonical SafeBreach research build with all eight variants and boost::log phase strings still in the binary; Sample C is a March 2026 ITW campaign artifact whose .text is byte-identical to Sample B after trim, wrapped in a hasherezade pe_to_shellcode reflective loader with a malformed-MZ trampoline. Includes a cross-variant YARA rule with four detection paths, five draft capa nursery candidates for the variants no one has rules for, and a CRC32-IEEE-802.3 API-hash reverser for the wrapper.

2026-05-03T20:00:00-04:00 2026-05-03T20:00:00-04:00 https://taogoldi.github.io/reverse-engineer/blog/guloader-nsis-shellcode-loader/ Tao Goldi

Reversing a 2025 GuLoader (CloudEye) NSIS-3 build that drops 19 files into %TEMP% under 17.6 MB of constant-byte sandbox-bypass padding, builds Windows API names from random Danish nouns to call through the System.dll plugin, decodes a 4-byte-XOR'd shellcode container, hash-resolves 31 APIs, and stages an MPRESS-packed Remcos 7.2.3 Pro from Google Drive that beacons raw TCP to 31.57.184.186:2404.