Binary Analysis Work

Excerpts from malware analysis reports I have done in the past and other security-related work. Contains unpacking methods, attribution, IOCs, and detection engineering recommendations. Note that downloads may contain live samples. If you choose to download, precede with caution! Passwords for downloaded files is industry standard.

• File Analysis - 2025:05:12

  A PowerShell downloader and a UPX-packed second stage that fetches its third stage.

  PowerShellUPXUnpacking

• File Analysis - 2024:12:30

  A PowerShell download chain ending in a fake installer that loads obfuscated shellcode.

  PowerShellShellcodeDynamic analysis

• File Analysis - 2023:10:19

  A likely .NET remote access trojan that persists with scheduled tasks and injects into Microsoft .NET binaries.

  RAT.NETPersistence

• File Analysis - 2023:10:13

  A Loki stealer loader hidden behind junk code, with Zeus-derived shellcode that resolves APIs by CRC32.

  LokiShellcodeOpaque predicates

• File Analysis - 2023:09:19

  A .NET Reactor-packed Zgrat sample that combines the RedEnergy stealer with ransomware behavior.

  ZgratRansomware.NET

• File Analysis - 2023:07:07

  A three-stage Windows loader: a dropper, an obfuscated DLL, and a payload unpacked from memory with its XOR-hidden C2 URLs.

  Windows PEUnpackingx32dbg

• File Analysis - 2023:06:20

  Zloader: Anti-analysis, string encryption, and evasion.

  ZLoader

• File Analysis - 2023:03:23

  DarkSide ransomware: key generation, dynamic API resolution, and decrypting its embedded configuration.

  DarkSideRansomwareGhidra

• File Analysis - 2023:02:07

  A Visual Basic wrapper that unpacks GuLoader, and the anti-VM, anti-debugging, and anti-EDR tricks inside it.

  GuLoaderShellcodeAnti-analysis

• File Analysis - 2022:07:27

  A .NET AgentTesla variant delivered through four stages, each unpacked by hand with dnSpy.

  AgentTesla.NETdnSpy

• File Analysis - 2022:07:27 (2)

  An Excel macro that chains mshta and PowerShell to a loader DLL that unpacks Emotet.

  EmotetOffice macrosFiddler

• File Analysis - 2022:04:20

  A .NET executable posing as a web browser that tries to fetch its second stage from a Discord server.

  .NETDiscordOpaque predicates

• File Analysis - 2022:03:14

  An Excel 4.0 macro dropper delivering the Emotet 'ChartDemo' DLL through regsvr32.

  EmotetExcel 4.0 macrosregsvr32