Research reports

public-research/reports/2026-07-24-jackskid-residential-proxy-upnp.md at main · deepfield/public-research

Most residential-proxy malware works hard to stay invisible. The infected device dials out to a director, holds the connection open, and tunnels customer traffic back through it. Nothing listens; nothing is reachable from the internet; the only footprint is…

MalwareAnalysisReports/LockBit5.0/Lockbit 5.0 loader analysis.md at main · VenzoV/MalwareAnalysisReports

By VenzoV Sample Information SHA256 180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38 Summary of execution flow JMP address values iare obfuscated using opaque predicates and MBA. Antidebug checks( NtGlobalFlag,PEB-> BeingDebugged,…

RansomwareMalware

GitHub - muhammadzidane632/Hopeless: Ransomware Wiper Bootkit Hybrid (Real Author Only Zdn2Pwn) Look at Date the Initial Commit

A C-based malware research framework designed to demonstrate advanced multi-stage system compromise techniques on Windows. This project is intended solely for educational purposes, security research, and understanding offensive techniques in a controlled…

RansomwareMalware

public-research/jackskid/report.md at main · deepfield/public-research

Reverse-engineering Jackskid: from bare-bones Mirai fork to persistent TV box botnet Nokia Deepfield Emergency Response Team (ERT) and Comcast Threat Research Lab (CTRL) First published: 2026-03-24 Content warning: This report quotes malware artifacts…

Botnets and DDoS

GitHub - es3n1n/defendnot: An even funnier way to disable windows defender. (through WSC api)

Using this tool to facilitate malware distribution, cybercrime, unauthorized access, evading detection, or any illegal activity is strictly prohibited. Users assume all legal responsibility for how they use this tool and any consequences thereof. You must…

GitHub - vxaboveground/Overlord: Overlord

Hello, I made this project for fun. The server is TypeScript on Node/Bun. The client is Go. Operators talk to the server through a web panel or the Electron desktop app, and agents connect over encrypted WebSockets. Docker is the easiest way to run it. Quick…

MacProStorage02:_2018ROW:Bitdefender-Whitepaper-Inexsmar-crea1598-A4-en_EN:Bitdefender-Whitepaper-Inexsmar-crea1598-A4-en_EN.indd

FOR MORE INFORMATION VISIT: enterprise.bitdefender.com Bitdefender is a global security technology company that delivers solutions in more than 100 countries through a network of value-added alliances, distributors and reseller partners. Since 2001,…

IoCs/Broadbased/frat.md at master · jeFF0Falltrades/IoCs

Note: I have not seen much coverage of this malware family. The name 'FRat' was derived from research by @James_inthe_box, seen in the linked Tweet thread below. If you have more information on this threat, please contact me on Twitter A RAT employing…

Malware

GitHub - mauronz/binja-emotet

Deobufscate API calls and strings in unpacked Emotet samples. Description: Helper plugin for the analysis of unpacked Emotet samples. Locate dynamically imported API functions and add tags to make them easily searchable.