Pony/Fareit: Inside the Credential Machine That Targeted 60+ FTP Clients

Reverse-engineering a 2012-era Pony/Fareit credential stealer: the GetTickCount-mod-7 anti-emulation gate that stalls Speakeasy at 9,980 ticks, MD5-vs-API-hashing identification, and released Python and IDAPython tooling.

Apr 16, 2026 malware-reversing, threat-intel

ZyreC2: The Game-Obsessed Mirai Fork That Left Its Homework Out

Deep-dive analysis of ZyreC2, a Mirai-derived Linux DDoS botnet with a nine-method Minecraft flooder, Discord attack module, and VSE targeting — whose developer forgot to strip debug symbols.

Apr 14, 2026 malware-reversing, threat-intel

NanoCore RAT v1.2.2.0: Dissecting a Persistent Commercial Trojan

NanoCore has been lurking in the threat landscape since at least 2013, when its original author sold the builder kit on underground forums for around $25. More than a decade later the tooling keeps...

Apr 13, 2026 malware-reversing, threat-intel

Dissecting a Chaos/Ares Go Botnet: 12 DDoS Vectors, DNS C2, and 11 Linux Persistence Mechanisms

Static analysis of a 2MB Go-compiled Linux DDoS botnet from the Chaos/Kaiji family, Ares variant. 12 attack vectors, DNS-based C2 with AES/DES encryption, SOCKS5 proxy, reverse shell, and 11 persistence mechanisms including SELinux policy bypass.

Apr 12, 2026 malware-reversing, threat-intel

Reversing a Custom Cipher to Extract Quasar RAT: From Raw Disassembly to Decrypted C2 Config

Reverse engineering a custom byte-level cipher from raw x64 disassembly to extract a 3.2MB Quasar RAT payload, then cracking the PBKDF2/AES-256 config to reveal the C2 server. Full Python extraction pipeline included.

Apr 11, 2026 malware-reversing, threat-intel

DcRAT in 48KB: Cracking the Config, Mapping the Plugin Loader, and Why the Stub IS the Malware

Reversing a 48KB DcRAT stub, cracking AES-256 encrypted config via PBKDF2 key derivation, mapping the fileless plugin architecture, and documenting why a minimal loader with zero offensive code scores 100/100 on CAPA.

Apr 10, 2026 malware-reversing, threat-intel

XWorm crypter analysis with bootkit and rootkit

Cracking a .NET Crypter to Extract a Weaponized XWorm: Bootkit, Rootkit, and a Zero-Day UAC Bypass

Tearing apart a .NET crypter to extract dual XWorm RAT payloads, then decompiling the RAT to find a UEFI bootkit with BlackLotus DBX bypass, an r77 rootkit, driver infection, CVE-2026-20817 zero-day UAC bypass, and D/Invoke API evasion.

Apr 9, 2026 malware-reversing, threat-intel

Backdoor.Win64.Gsb: A Go Implant Hiding Behind Nuclear Reactor Simulations

Reversing a novel Go-compiled backdoor distributed by GCleaner that uses nuclear reactor physics type names and CJK-obfuscated function names to evade detection, with only 15.8% VirusTotal detection despite allocating RWX memory and calling SyscallN directly.

Apr 8, 2026 malware-reversing, threat-intel

njRAT v0.7d 'HacKed' Campaign: Config Extraction, C2 Protocol, and Full Capability Mapping

Static analysis of a novel njRAT v0.7d im523 build with 'HacKed' campaign tag: C2 config extraction, 30+ command dispatch mapping, USB worm propagation, and credential theft, with reproducible Python tooling and YARA rules.

Apr 7, 2026 malware-reversing, threat-intel

Pulsar RAT .NET Reversing: C2 Protocol Recovery, Costura Extraction, and DPAPI Credential Theft Pipeline

Offline static analysis of an MPRESS-packed Pulsar RAT variant: Costura extraction, AES-256 C2 protocol reversal, DPAPI credential theft, ConfuserEx deobfuscation, and Windows RE persistence, with reproducible tooling and YARA rules.

Apr 6, 2026 malware-reversing, threat-intel