Content Paint
Embee Research

Featured Posts

Tracking APT SideWinder Domains By Combining Regex Patterns, Whois Records and Domain Registrars
Tracking APT SideWinder Domains By Combining Regex Patterns, Whois Records and Domain Registrars

Tracking APT SideWinder Domains With Regular Expressions, Whois Records and Domain Registrars

Tracking Gamaredon Infrastructure With Passive DNS Records and Subdomain Analysis
Tracking Gamaredon Infrastructure With Passive DNS Records and Subdomain Analysis

Leveraging Passive DNS to identify APT infrastructure. Building on public intelligence reports.

Advanced CyberChef Techniques For Malware Analysis - Detailed Walkthrough and Examples
Advanced CyberChef Techniques For Malware Analysis - Detailed Walkthrough and Examples

Advanced CyberChef techniques using Registers, Regex and Flow Control

Recent Posts

How To Track Quasar Rat C2 Infrastructure Using TLS Certificates
How To Track Quasar Rat C2 Infrastructure Using TLS Certificates

Extraction of Quasar C2 configuration via Dnspy, and using this information to pivot to additional servers utilising Shodan and Censys.

AgentTesla Malware Analysis - How To Resolve API Hashes With Conditional Breakpoints

Analysis of a Multi-Stage Loader for AgentTesla. Covering Ghidra, Dnspy, X32dbg, API Hashing and more!

Amadey Bot Malware Analysis - Static Analysis and C2 Extraction With Ghidra and x64Dbg
Amadey Bot Malware Analysis - Static Analysis and C2 Extraction With Ghidra and x64Dbg

Using manual analysis to extract Amadey C2 information with Ghidra and x32dbg

Dcrat Malware Analysis - How to Manually Decode a 3-Stage Malware Sample

Manual analysis and deobfuscation of a .NET based Dcrat. Touching on Custom Python Scripts, Cyberchef and .NET analysis with Dnspy.

Your link has expired. Please request a new one.
Your link has expired. Please request a new one.
Your link has expired. Please request a new one.
Great! You've successfully signed up.
Great! You've successfully signed up.
Welcome back! You've successfully signed in.
Success! You now have access to additional content.