f4n6.co.uk - October 2026 - TLP:CLEAR. All indicators are defanged. Hash: f745c2d897ad6f16cb5c0428ba74a7f041f7c3e94f52cc3727532577fe12507d 0:00 /2:34 1× TL;DR * A 9 MB, 64-bit Windows
A 12 MB batch file that unpacks a genuine, signed ScreenConnect client wired to an attacker's relay, disables every user-visible indicator, survives reboot and Safe Mode — and what it looks like on a real infected host.
A loader disguised as libcurl refuses to run on VMs and dies silently in sandboxes. We patched its six anti-VM checks out and captured its WebSocket C2 on port 406.
A 3.5 KB Windows loader with one import, a split-up C2 address, and a forty-byte handshake it repeats until somebody answers. We answered
A 15 KB DLL that silently rewrites cryptocurrency addresses on your clipboard. I pulled it apart statically, confirmed it in a sandbox, recovered all nine of
A Go crypter, a RAT with SQLite in its WebAssembly belly, and an encrypted C2 configuration that eventually introduced itself through an error message. The salad
Part 1 told you what Overlord RAT is. This post is the 48 hours after that: we rebuilt its C2 in an offline lane, drove the
How a routine MalwareBazaar pull turned into a full teardown of a Go surveillance implant that hides its operator on a virtual monitor and how an
We took two C2 IP addresses from a malware news article and pivoted through Shodan, DNS, reverse MX lookups, certificate transparency, WHOIS, and MITRE ATT&