Intel x86-64 CPU Internals

My notes on x86-64 CPU internals: execution modes, segmentation, interrupts, system calls, paging, debugging registers, and port I/O.  git...

Inside MacSync: The Stealer Silently Backdooring Ledger Wallets

  This was a collaboration article with Abdelghafour Bouhdyd (  @1nt3l_hunt  ) about a MacSync Stealer compaign. It can be found on his blog...

Quirks of an EDR: Usermode

Introduction EDR vendors solve the same problems, they just do it differently. This causes logical pitfalls to occur. This is a work in prog...

Another example of an Opsec failure in malware C2 Panels

 Introduction This is not going to be a long article. I wrote some article before about blunders in malware infrastractures. Some threat act...

Gremlin Stealer: Strings decryption + Where data is uploaded

 Introduction This is a quick static analysis blog post. 

Quick LummaC2 discussion (fnv1a instead of murmur2 !?)

 Introduction This is by no means a thorough analysis. It's merely a quick discussion and highlight of my findings while working on a ne...

Unpacking and Analyzing Purelog Stealer (ft. a quick trick using Powershell)

 Introduction In this blog post, I'll be showcasing via example a useful trick to invoke .NET methods from Powershell and skipping all t...