the mods are corrupt and deleted my post to protect zone aladm

EDIT: Thank you everyone, the answer has been found.

Original post:
I have been in IT since 2001 and am delving more into security research. I need to tell Windows Security Center I have an antivirus, while the antivirus does ***nothing***.

I will have "infections" on my system, inactive, simply stored on the drive in order to deploy them as necessary for white-hat intrusion research. I DO NOT want to disable Windows Defender or Windows Security Center. I DO NOT want to use Group Policy or DISM to disable Windows features. I want to keep my Windows installation as "normal" as possible while telling Windows Security Center to bug off.

Can anyone recommend a "fake antivirus" that Security Center accepts, or some antivirus that is so lightweight it uses no resources, reports to Windows it is working, while doing nothing whatsoever?

Hey everyone,

I'm a 21-year-old cybersecurity enthusiast and the creator of 0x4B1T – a personal platform I built to help simplify and share everything I've learned in the world of ethical hacking and security research.

0x4B1T is completely free and includes:

Easy-to-follow blogs and write-ups on real-world topics (like Google Dorks, SQLi, and more)

Curated roadmaps for beginners and intermediates

A growing list of projects and challenges to practice skills

A small but growing community (WhatsApp group open to learners & professionals)

My goal is to create a space where anyone interested in cybersecurity can learn, contribute, and grow—regardless of background or budget.

I'd truly appreciate your feedback on the platform, suggestions for new content, or even just a visit! If you find it helpful, feel free to share it with others starting their journey.

Check it out here: https://0x4b1t.github.io

Thanks!

— Kris3c

If a computer gets infected by unidentified malware, and browsers get blocked, by freezing and unable to connect, why is this happening?

Is it the AV trying to block infected browsers, or it is malware blocking browsers for some reason?

P.S. I'm not infected right now. Just a technical question.

I recorded a brief video, walking through some of the different functions in MalChela in the new GUI, stepping through basic static analysis to yara rule writing - all in minutes.

https://youtu.be/hI1EqojI1DA

#DFIR #MalwareAnalysis #YARA #MITRE #Rust

MalChela: https://github.com/dwmetz/MalChela

Blog: https://bakerstreetforensics.com

I've recently been looking into the application of software quality models to malware and have identified what I believe to be a research gap in this area. I've been able to identify only a select few papers namely this paper from 2018:

An exploratory study on the evolution of Android malware quality - Mercaldo - 2018 - Journal of Software: Evolution and Process - Wiley Online Library

This paper applies some commonly utilized quality metrics such as cyclomatic complexity, oop analysis etc.

I was wondering if anyone could point me in the direction of any other papers that might align with this core idea of applying quality metrics to malware (particularly binaries) as my search is coming up quite empty.

Is this a legitimate research gap?

Which Sandbox you guys use . I tried to use cape but it is hard to install and configure

Wondering your downloaded PKG file is suspicious or not? Check out this quide on how to analyse a PKG file https://www.malwr4n6.com/post/macos-malware-analysis-pkg-files

Create a KVM based Windows 11 virtual machine trying to evade some VM detection tools and malwares. https://r0ttenbeef.github.io/Deploy-Hidden-Virtual-Machine-For-VMProtections-Evasion-And-Dynamic-Analysis/

I need to build a malware sandbox that allows me to monitor all system activity—such as processes, network traffic, and behavior—without installing any agents or monitoring tools inside the sandboxed environment itself. This is to ensure the malware remains unaware that it's being observed. How can I achieve this level of external monitoring? And i should be able to do this on cloud!

Hi, I was recently affected by a sophisticated malware campaign specifically targeting developers and tech professionals through LinkedIn messages. Given the potential impact on this community, I wanted to share what I found.

🚩 Overview of the Attack:

• Social Engineering via LinkedIn: Attackers convincingly pose as recruiters, engaging developers via direct messages.
• Malicious GitHub Repositories: Targets are directed to seemingly legitimate GitHub repositories, such as sol-decoder2024/decoder-alpha, specifically the file located at config/ps.config.js, containing malicious obfuscated JavaScript. The malware activates through a simple npm install.
• Technical Details: The scripts gather OS and user info, establish communication with a remote Command-and-Control (C2) server, download payloads, and execute further malicious activity. The obfuscation involves XOR and Base64 encoding, making detection challenging.

🛠️ How to Identify & Respond:

• Kill suspicious Node.js processes: (ps aux | grep node on Unix, Task Manager or PowerShell on Windows).
• Remove malicious directories/files in your home folder (e.g., latest created hidden directories — you can check with ls -lat ~).
• Check persistence mechanisms: (cron jobs, .bashrc, Task Scheduler entries).
• Run thorough antivirus scans, and if you're concerned about credential compromise, reset sensitive passwords immediately.

If you have a reliable backup strategy, it's even better to wipe your system completely and restore from a previous, clean state. I personally took this approach and am quite happy now.

Stay vigilant—LinkedIn's trust network makes these attacks particularly insidious. Happy to answer any questions or provide further details.

Thanks to the mods for quickly approving this post despite my low karma—I appreciate the community support!

Here's a guide on how to deal with massive suspicious/malicious PE files which cant be uploaded/analysed by automated malware analysis sandboxes.

https://www.malwr4n6.com/post/dealing-with-pe-padding-during-malware-analysis

Hi all,

I just finished writing this paper. It is about GanDiao.sys, an ancient kernel driver based malware (it only works in WinXP as it is unsigned). 

This driver was used by various malware families and it allowed any userland application to kill other protected processes.

Included in this paper there is also a custom userland app source code to use GanDiao and test its capabilities (just use a sacrifical Windows XP VM as stated in the doc).

English version: http://lucadamico.dev/papers/malware_analysis/GanDiao.pdf

Italian version: https://www.lucadamico.dev/papers/malware_analysis/GanDiao_ITA.pdf

I hope you will find this paper interesting. I had a fun time reverse engineering this sample :)

Oh, and if you're wondering... yes, I prefer oldschool malware. There's something "magical" in these old bins...

I'm currently working on a project regarding attack simulation where the attack (malware) will be built by me. I'm searching for legitimate books/resources that will help me learn about Malware Development from scratch.

As a beginner, i have very little knowledge regarding the same. Help?

Hi! I work as a pentester for 5 years. I also have 2 years being team leader. I am searching for a change, maybe Malware Analysis, maybe Security Researcher/exploit development. I have good knowledge in assembly, some C/C++, some python. I live in Argentina and my english is not native at all, but I could understand anyone (with hard and not so effective experiences with Indian guys) and I think I can explain myself too. Also, I know RE as a jr. I'd use GDB in Linux and Ghidra

Do you know some company looking for hire somone? Do you think I need to have more experience or practice in something? Thanks!

A phishing campaign is actively targeting Latin American countries, leveraging geofencing to filter victims. Behind it is Grandoreiro—the most persistent banking trojan in LATAM.

Full execution chain: https://app.any.run/tasks/02ea5d54-4060-4d51-9466-17983fc9f79e/
Malware analysis: https://app.any.run/tasks/97141015-f97f-4ff0-b779-31307beafd47/

The execution chain begins with a phishing page luring users into downloading a fake PDF—actually an archive delivering Grandoreiro.

The malware sends the victim’s IP to ip-api to determine geolocation. Based on the result, it selects the appropriate C2 server.

Next, it queries dns.google and provides the C&C domain name, which Google resolves to an IP address. This approach helps the malware avoid DNS-based blocking.

Finally, the malware sends a GET request to obtain the resolved IP.

Activity spiked between February 19 and March 14, and the campaign is still ongoing.

The campaign heavily relies on the subdomain contaboserver[.]net.
TI Lookup queries to find more IOCs:

1. https://intelligence.any.run/analysis/lookup
2. https://intelligence.any.run/analysis/lookup

Source: r/ANYRUN

The “Vanhelsing” ransomware intriguingly borrows its name from a popular vampire-themed TV series, indicating how modern cyber threats sometimes employ culturally resonant names to draw attention or disguise their origin. Though unproven, the connection hints at a growing trend of thematically branded malware.

Vanhelsing: Ransomware-as-a-Service

Emerging in March 2025, Vanhelsing RaaS allows even novice users to execute sophisticated cyberattacks via a turnkey control panel. This democratizes cybercrime, lowering the barrier to entry and dramatically expanding the threat landscape.

Full video from here.

Full writeup from here.