Pulsar RAT .NET Reversing: C2 Protocol Recovery, Costura Extraction, and DPAPI Credential Theft Pipeline

Offline static analysis of an MPRESS-packed Pulsar RAT variant: Costura extraction, AES-256 C2 protocol reversal, DPAPI credential theft, ConfuserEx deobfuscation, and Windows RE persistence, with reproducible tooling and YARA rules.

Apr 6, 2026 malware-reversing, threat-intel

Kaiji-Like Linux ELF Reversing: Persistence, C2 Token Recovery, and Ares Module Mapping

Offline static analysis of a Kaiji-like Linux ELF sample: persistence, decoded C2 token, Ares module mapping, and reproducible analyst artifacts.

Mar 6, 2026 malware-reversing, threat-intel

Mirai-like Stage1 analysis social preview card

Mirai-like ELF Reversing, Part I: Stage1 Trust Gate, Command Dispatch, and Killer Loop

Static analysis of a Mirai-lineage ELF bot covering C2 trust verification, seven-method command dispatch, anti-competition killer logic, and reproducible extraction scripts.

Feb 25, 2026 malware-reversing, threat-intel

Stage1 22.exe loader reverse-engineering analysis

Stage1 (22.exe) Loader Reversing, Part I: Stage Decryption, Evasion, and Attribution

Reverse engineering a staged loader that patches AMSI and ETW, decrypts an AES-256-CBC payload in memory, and hands off to a Vidar-like credential stealer.

Feb 23, 2026 malware-reversing, threat-intel

From log.dll To A Decrypted Chrysalis Main Module

End-to-end offline unpacking of the Lotus Blossom Chrysalis backdoor chain, from DLL sideloading through shellcode extraction, region decryption, and RC4 config recovery, without a live Windows debugger.

Feb 20, 2026 malware-reversing, threat-intel

Pulsar RAT .NET Reversing: C2 Protocol Recovery, Costura Extraction, and DPAPI Credential Theft Pipeline

Kaiji-Like Linux ELF Reversing: Persistence, C2 Token Recovery, and Ares Module Mapping

Mirai-like ELF Reversing, Part I: Stage1 Trust Gate, Command Dispatch, and Killer Loop

Stage1 (22.exe) Loader Reversing, Part I: Stage Decryption, Evasion, and Attribution

From log.dll To A Decrypted Chrysalis Main Module

Trending Tags