Analysis - f4n6

malware

Salad on the Side: Unpacking LunarCrypt and the SalatStealer RAT

A Go crypter, a RAT with SQLite in its WebAssembly belly, and an encrypted C2 configuration that eventually introduced itself through an error message. The salad

12 Sep 2026 · 10 min read read →

Reverse Engineering

Inside Overlord RAT, Part 2: Emulating the C2, Cracking the Command Bus, and Catching the Implant Killing Itself

Part 1 told you what Overlord RAT is. This post is the 48 hours after that: we rebuilt its C2 in an offline lane, drove the

10 Sep 2026 · 15 min read read →

malware

Overlord RAT: Hidden Desktops, Solana-Driven C2, and a Screen the Victim Never Sees, Part 1

How a routine MalwareBazaar pull turned into a full teardown of a Go surveillance implant that hides its operator on a virtual monitor and how an

09 Sep 2026 · 8 min read read →