Beginner-friendly walkthrough of a MIPS Mirai/CondiBot variant called ohshit.mips: decoding the single-byte XOR strings, mapping a 21-slot function pointer table that turns out to be mostly unrelated to the C2 attack vocabulary, and tracing how genddos.st ends up as a DNS amplification payload instead of a C2 domain.
An ironically scientific investigation into the musical preferences of malware samples. Turns out, even malicious code has taste—sometimes literally obfuscated in Base64.
What makes this so clever is that it doesn’t rely on heavy obfuscation or complex anti-analysis tricks. Instead, it leverages the fact that many sandboxes rename files to generic …
Recently, I came across a compelling article titled “In the Wild: Malware Prototype with Embedded Prompt Injection,” published on June 25, 2025. This write-up explores a unique …
Recently, I came across a heavily obfuscated PowerShell script—the kind you’ll often see in real-world malware or red team payloads. In this post, I’ll walk you through the process …