Malware reverse engineering, DeFi review reports and original analysis tools. With pinned review records, code, findings, counterchecks and explicit claim limits.
Long-form analysis. Independent perspectives. Visible limits.
Every entry states its review record, method, result and limit. Counts come directly from the published archive; private findings and raw samples are excluded.
20 audits
Technical source review of the configurable Windows loader: resource format, layered decryption, anti-analysis, execution paths, persistence and defensible detection signals.
Source-bound reconstruction of two attack chains observed in 2026: ClickFix, WebDAV, Python persistence, MSHTA, steganography and browser-data theft.
Static review of the open C# codebase: compressed MessagePack, handlers, plugins, persistence and variant risk.
Version-bound macOS analysis of malvertising, DMG social engineering, string obfuscation and collection from browsers, Keychain and wallets.
Technical reconstruction of the modular loader: PNG transport, XOR/LZNT1, syscall evasion, anti-VM and scheduled-task persistence.
Analysis of the MaaS architecture documented in 2025: obfuscation, browser and wallet access, tiered C2 resolution and follow-on account risk.
Version-bound analysis of the loader rebuilt in 2024: simplified obfuscation, ephemeral configuration, host profiling and changed HTTP C2.
Static source review of the archived open C# codebase: protobuf messages, client/server separation, persistence and defensive observation points.
Historical reconstruction of the worm and loader chain: removable media, LNK, cmd/msiexec, compromised NAS systems and the boundary to follow-on payloads.
Historical architecture analysis of the Delphi ransomware path: CFGS resource, AES-CBC-RBT, RSA/AES-OFB, variable footer and wiper separation.
Government-source reconstruction of a multi-stage intrusion with alternate initial access, registry staging, process injection and bounded signatures.
This investigation connects three distinct layers of the same ecosystem: a native BoxedApp container, a DNGuard-protected management panel and a two-stage .NET bot with an authenticated C2 protocol and process hollowing.
An obfuscated provider, resolved string table, recipient addresses and telemetry. What the code establishes — and why this copy does not contain a complete backend.
The claim interface, transaction authorizations and backend control in the archived XRPL controller. With code, C2 indicators and a separate assessment of the other cases.
Bounded review of purpose, outputs and claim limits of our tools. No certification or full code audit of every release.
The 8–9 October 2026 audit archive supports a High lending finding and a Medium bridge assessment. This review explains the evidence, counterchecks and rules for remediation verification.
HighCritical: Not confirmed
The assessment of 9 October 2026 separates model evidence from demonstrated operational conditions. Low is established; Medium remains conditional.
LowCritical: Not confirmed
Historical review confirms a bounded accounting observation. Counterreview supports neither the stronger Critical interpretation nor a newly assigned High label.
UnratedCritical: Not confirmed
Counterreview confirms no new exploitable candidate in the documented V2.1 slice. Audit history and limited state coverage determine the result.
No new findingCritical: Not confirmed
Low/Medium for the historical accounting observation; a separate Critical candidate was rejected. The report keeps the two dispositions separate.
Low / MediumCritical: Rejected — not validated
Start a conversation