Content Paint
Embee Research

Malware Analysis

How To Decode Visual Basic (.vbs) Malware - DarkGate Loader
How To Decode Visual Basic (.vbs) Malware - DarkGate Loader

Demonstrating basic techniques for decoding a darkgate .vbs loader.

How To Write a Simple Configuration Extractor For .NET Malware - RevengeRAT
How To Write a Simple Configuration Extractor For .NET Malware - RevengeRAT

Introduction to dotnet configuration extraction. Leveraging RevengeRat and Python.

Code Snippets For Dotnet Configuration Extractors
Code Snippets For Dotnet Configuration Extractors

Useful code snippets for developing dotnet configuration extractors.

AgentTesla Malware Analysis - How To Resolve API Hashes With Conditional Breakpoints

Analysis of a Multi-Stage Loader for AgentTesla. Covering Ghidra, Dnspy, X32dbg, API Hashing and more!

Amadey Bot Malware Analysis - Static Analysis and C2 Extraction With Ghidra and x64Dbg
Amadey Bot Malware Analysis - Static Analysis and C2 Extraction With Ghidra and x64Dbg

Using manual analysis to extract Amadey C2 information with Ghidra and x32dbg

Dcrat Malware Analysis - How to Manually Decode a 3-Stage Malware Sample

Manual analysis and deobfuscation of a .NET based Dcrat. Touching on Custom Python Scripts, Cyberchef and .NET analysis with Dnspy.

Your link has expired. Please request a new one.
Your link has expired. Please request a new one.
Your link has expired. Please request a new one.
Great! You've successfully signed up.
Great! You've successfully signed up.
Welcome back! You've successfully signed in.
Success! You now have access to additional content.