6000+ SAMPLES · RE
Malware Reverse Engineering
Unpacking and reversing ransomware, RATs, droppers and info-stealers to understand exactly what they do — and detect them.
5
Deliverables
11
Tools
2
Attacks covered
What I deliver
- Static triage: packers, imports, strings, capabilities
- Dynamic analysis in FLARE VM and REMnux
- Unpacking, deobfuscation and C2 config extraction
- YARA rules that survive new variants
- IOCs and ATT&CK mapping handed to the SOC
⟩ how I approach it
Step by step
- 01
Identify packer and compiler
- 02
Unpack and dump the real payload
- 03
Reverse key routines in Ghidra / x64dbg
- 04
Extract C2 config and capabilities
- 05
Write YARA and IOCs for the SOC
⟩ who it's for
SOC and IR teamsThreat intel analystsCompanies facing a targeted sample
⟩ real-world projects
Selected engagements
From my work at BERRY9 IT Services, as a freelancer, at CRIS InfoTech and Hacktr Technologies, and my own tools and research.
01
Reverse engineering of RATs and info-stealers — unpacking, C2 extraction and persistence mapping with Ghidra and x64dbg
02
YARA rule pipeline — family-level rules tested against clean files before deployment
⟩ common vulnerabilities & how I find them
Top bugs I hunt — and the steps
The recurring weaknesses I see in this domain, with the repeatable workflow I run from discovery to fix.
- STEP 1Identify the packer with DIE
- STEP 2Run to OEP in x64dbg and dump the payload
- STEP 3Rebuild imports and analyse the real binary
- STEP 4Write YARA for the unpacked family
⟩ arsenal
Tools & frameworks
Ghidra
Reverse Engineering
IDA Free
Disassembler
x64dbg
Windows Debugger
dnSpy
.NET Reversing
Detect It Easy
Packer Detection
PE Studio
PE Static Analysis
Procmon
Process Monitoring
RegShot
Registry Diff
FakeNet
Network Simulation
YARA
Pattern Matching
CyberChef
Decode & Transform
⟩ engage
Need malware reverse engineering expertise?
⟩ related
More in Blue Team Operations
Purple Team Exercises
Runs red and blue side by side, technique by technique, so every gap turns into a shipped detection the same week.
SIEM Engineering
Designed scalable log pipelines and high-fidelity detections.
Threat Intel & Dark Web Monitoring
Turning IOCs, actor chatter and leaked data into intelligence a SOC can act on — passive and lawful only.
Incident Response
Containment, eradication and recovery for active breaches.
Threat Hunting
Hypothesis-driven hunts using behavioral analytics.
EDR Management
Deployed and tuned EDR fleets across enterprises.