Research reports
1,224 reports from 387 publishers45 added in the past week
16 reports, newest added first
Added Sun 18 Oct
GitHub - GhostPack/SafetyKatz: SafetyKatz is a combination of slightly modified version of @gentilkiwi's Mimikatz project and @subtee's .NET PE Loader
First, the MiniDumpWriteDump Win32 API call is used to create a minidump of LSASS to C:\Windows\Temp\debug.bin. Then @subtee's PELoader is used to load a customized version of Mimikatz that runs sekurlsa::logonpasswords and sekurlsa::ekeys on the minidump…
Malware
Added Fri 16 Oct
cti/runster/readme.md at main · cert-orangecyberdefense/cti
Update (2026-06-17): our related "Payload C" is likely tied to MetaStealer and was recently detailed by Huntress, which named it Potemkin loader. Another blog by Walmart on this new DGA is available here. Orange Cyberdefense CERT has been tracking a…
Malware
Added Sat 10 Oct
GitHub - yankywilson/jdy-botnet-threat-analysis: Defensive CTI analysis of the JDY reconnaissance botnet (China-nexus, Volt Typhoon / KV lineage, MITRE G1017): MIPS64 implant reverse engineering, infrastructure enumeration, tiered intelligence reporting, Sigma/YARA detections, and a tasking decryptor. TLP:CLEAR.
A complete defensive analysis of the JDY botnet: reverse engineering of the implant, enumeration of its control infrastructure, three-tier intelligence reporting, deployable detections, and a working tasking decryptor. JDY is a China-nexus reconnaissance…
State-sponsoredMalwareBotnets and DDoS
Added Fri 9 Oct
XenoRAT-Malware-Analysis/Reports/XenoRAT_EN.md at main · Yavuzhanzgen/XenoRAT-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. XenoRAT Technical Analysis Report Static Analysis • Dynamic Analysis •…
Malware
Added Wed 7 Oct
threat-research/ancient-botnet at main · ksi-digital/threat-research
We captured a botnet family that calls itself "ancient" in our SSH/Telnet honeypot. Between 2026-10-04 and 2026-10-05 we observed its delivery chain, three iterations of its dropper, and its C2 behaviour. We confirmed its C2 server live. We have not found a…
MalwareBotnets and DDoS
Added Sat 26 Sep
Amadey-Malware-Analysis/Reports/Amadey_EN.md at main · Yavuzhanzgen/Amadey-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. Amadey Technical Analysis Report Static Analysis • Dynamic Analysis •…
Malware
ValleyRAT-Malware-Analysis/Reports/ValleyRat-EN.md at main · Yavuzhanzgen/ValleyRAT-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. ValleyRAT Technical Analysis Report Static Analysis • Dynamic Analysis •…
Malware
KoiLoader-Malware-Analysis/Reports/KoiLoader-EN.md at main · Yavuzhanzgen/KoiLoader-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. KoiLoader Technical Analysis Report Static Analysis • Dynamic Analysis •…
Malware
XWorm-Malware-Analysis/Reports/XWorm_v3.1_Report_EN.md at main · Yavuzhanzgen/XWorm-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples have been analyzed in an isolated laboratory environment. XWorm V3.1 Malware T Static Analysis • Dynamic Analysis • Reverse…
Malware
XoriumStealer-Malware-Analysis/Reports/XoriumStealer-EN.md at main · Yavuzhanzgen/XoriumStealer-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. Xorium Stealer Malware T Static Analysis • Dynamic Analysis • Reverse…
Malware
Added Thu 17 Sep
StealC-Malware-Analysis/Reports/StealC-V2-EN.md at main · Yavuzhanzgen/StealC-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. StealC V2 Malware Technical Analysis Static Analysis • Dynamic Analysis •…
MalwareInfostealers
Added Tue 15 Sep
AsyncRAT-Malware-Analysis/Reports/AsyncRAT-EN.md at main · Yavuzhanzgen/AsyncRAT-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. -EN.md at main · -Malware-Analysis AsyncRAT Technical Analysis Report…
Malware
BabylonRAT-Malware-Analysis/Reports/BabylonRAT-EN.md at main · Yavuzhanzgen/BabylonRAT-Malware-Analysis
This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All analyses were conducted in an isolated laboratory environment. -EN.md at -Malware-Analysis BabylonRAT Technical Analysis Report Static…
Malware
Added Tue 28 Jul
MalwareAnalysisReports/LockBit5.0/Lockbit 5.0 loader analysis.md at main · VenzoV/MalwareAnalysisReports
By VenzoV Sample Information SHA256 180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38 Summary of execution flow JMP address values iare obfuscated using opaque predicates and MBA. Antidebug checks( NtGlobalFlag,PEB-> BeingDebugged,…
RansomwareMalware
Added Thu 23 Jul
GitHub - muhammadzidane632/Hopeless: Ransomware Wiper Bootkit Hybrid (Real Author Only Zdn2Pwn) Look at Date the Initial Commit
A C-based malware research framework designed to demonstrate advanced multi-stage system compromise techniques on Windows. This project is intended solely for educational purposes, security research, and understanding offensive techniques in a controlled…
RansomwareMalware
Added Fri 10 Apr
IoCs/Broadbased/frat.md at master · jeFF0Falltrades/IoCs
Note: I have not seen much coverage of this malware family. The name 'FRat' was derived from research by @James_inthe_box, seen in the linked Tweet thread below. If you have more information on this threat, please contact me on Twitter A RAT employing…
Malware
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.