Blog by Joren Vrancken

Part 1 - Part 2 This is the second blog in a malware analysis blog series analyzing an infection chain that starts with a game.

Part 1 - Part 2 Recently, we came across some malware masquerading as a game.

Substack is a popular blogging platform.

During reverse engineering, an analyst is trying to answer specific questions about the binary they are analyzing.

Recently, I created a simple tool, Carve Exe, to carve executables from other files (e.g. memory dumps or network traffic).

When a malware analyst gets a new malware sample to analyze, one of the first questions they might have, is what functions are called during the execution of the sample.

Last year, we published a blog post discussing an attack where a malicious actor hijacks Arch User Repository (AUR) vulnerable packages by registering expired domains.

Recently, we encountered an obscure security measure while researching GitHub repositories: the popular repository namespace retirement.

The Arch User Repository (AUR) is a software repository for Arch Linux.

GitHub Pages is a static content hosting service by GitHub.