Blog

Malware AnalysisShakil Hossain·15 Aug 2026

The final payload is a Go loader with the internal module name batman, whose single hardcoded GUID serves as both the API key and both AES keys. Recovering it compromises the protocol in full. Controlled interaction with the C2, and the panel's own error handling, exposed a multi-tenant loader-as-a-service platform.

Malware AnalysisShakil Hossain·15 Aug 2026

The chain installs Safetica's signed ProcessMonitor driver (CVE-2025-70795) and drives it over IOCTL to terminate PPL-protected security processes from kernel mode. The kernel call is only the fallback: a rule keyed on the driver misses the userland tier that fires first, against everything else on the host.

Malware AnalysisShakil Hossain·15 Aug 2026

A fake recruitment lure aimed at Bangladeshi digital-marketing professionals delivers a five-stage chain: a renamed, Microsoft-signed Word binary sideloads a 157 MB Go DLL, which unpacks an encrypted container holding a full CPython runtime and a signed kernel driver. Part 1 of 3 covers the delivery, the loader, and the single export that identifies the malicious DLL.

Malware AnalysisShakil Hossain·13 Aug 2026

The operators rotate delivery domains by writing one transaction to a smart contract. That transaction is public, permanent and attacker-authored — and following it back to the deploying wallets turned a two-contract incident into a 123-contract inventory with 36 live delivery domains. Part 3 of 3.

Malware AnalysisShakil Hossain·13 Aug 2026

Eight loaders were injected into one hacked page, pointing at two different smart contracts. A single visitor ran all of them. Part 2 of 3: what came out of the two archives, why they are the same stealer underneath, and the one builder field that separated a credential theft from a persistent RAT.

Malware AnalysisShakil Hossain·13 Aug 2026

A compromised Bangladeshi property site was serving a ClickFix lure — but the injected script contains no C2 domain. It asks a Polygon smart contract at page load, which means the operators rotate infrastructure without ever touching the hacked site again. Part 1 of 3: the delivery chain, end to end.

Malware AnalysisShakil Hossain·19 Jul 2026

A routine PureLogs sample led us somewhere uncomfortably close to home: everycarebd[.]com, answering on 103[.]112[.]62[.]142 — a Bangladeshi asset abused to stage a commodity info-stealer. Here is the full chain, from phishing lure to C2, and what local defenders should watch for.