• 52pojie Build Provenance `52pojie` (吾爱破解, "I Love Cracking") is a prominent Chinese reverse-engineering and software-cracking forum. Malware samples with PDB paths or build artefacts referencing `52pojie` may indicate:
• AES-Managed Overlay Decryption A payload-staging pattern in which a .NET binary carries its encrypted payload not in a manifest resource, but as a raw **file overlay** appended after the last PE section. The outer binary opens its
• AgentTesla .NET Infostealer AgentTesla is a commodity .NET Framework information stealer sold as malware-as-a-service. It targets browser credentials, clipboard data, keystrokes, screenshots, and email client credentials, exfilt
• AutoIt Compiled Script Dropper Malware delivered as a compiled AutoIt3 script (`.a3x` or `.exe` output from AutoIt compiler). The script is executed by the AutoIt3 interpreter, providing a Turing-complete scripting environment with
• Bitmap Steganography Payload Delivery A .NET malware payload-staging pattern where the encrypted or compressed payload is hidden inside embedded bitmap (BMP) image resources. The outer PE carries 8–24 small BMP files (typically 76×76×24 o
• Browser Credential Harvesting Cross-family technique: malware reads browser credential databases from local disk to extract saved passwords, cookies, and autofill data. Targets vary by family but commonly include Chromium-based br
• clipboard-hijack-cryptocurrency — Replacing copied wallet addresses with attacker-controlled ones Malware monitors the Windows clipboard for strings that match cryptocurrency address patterns. When the user copies an address (e.g., to send funds), the malware immediately replaces it in the clipboa
• debug-build-capa-false-positives Recurring false-positive pattern in Mandiant capa static analysis when targeting .NET Framework binaries compiled in **Debug** configuration. The presence of compiler-generated attributes that are har
• .NET Manifest Resource Decryption A common payload-staging pattern in .NET malware where the encrypted or compressed payload is embedded as a `Resource` (`.rsrc` / `ManifestResource`) inside the assembly metadata. At runtime, the load
• double-extension-masquerade A Windows-specific social-engineering technique where a PE executable is given a filename ending in a benign extension followed by the real `.exe` extension, e.g. `Invoice.pdf.exe`. Because Windows Ex
• Email Client Credential Theft Cross-family technique: malware extracts saved credentials, account settings, and mail stores from local email client applications. Targets vary by family but commonly include Outlook, Thunderbird, Fo
• Embedded RCData Encrypted Configuration Malware build pattern: runtime configuration (C2 host, port, mutex name, feature flags, credentials) is stored as an RCData resource inside the PE, encrypted to defeat static extraction. Decrypted at
• Embedded SHA256 Integrity Hash A hardcoded 64-character hexadecimal string appearing inside a binary's metadata (often the .NET `#Strings` stream or PE `.rsrc` section) that looks like a SHA-256 hash but whose purpose is not immedi
• FTP Exfiltration Cross-family exfiltration technique: malware uploads stolen data to an attacker-controlled FTP server. Less common than SMTP or Telegram exfiltration in modern crimeware, but still observed in older f
• Go Infostealer Build Pattern Recurring build artefacts observed in Go-based infostealers compiled for Windows. First documented in the PacketPursuit corpus for the [[acrstealer]] family, but the settings are generic and may appea
• IExpress SFX Dropper The Microsoft IExpress/Wextract self-extractor (`wextract.exe`) repurposed as a malware dropper. The outer PE is a legitimate Windows system binary that extracts an embedded Cabinet archive to a temp
• image-steganography-payload-delivery Malware technique: hide executable payloads inside seemingly benign image files (JPG, PNG, BMP) or text files using plaintext markers. The carrier file is hosted on free or legitimate services (Bitbuc
• inno-setup-legitimate-installer-abuse Threat actors repackage legitimate open-source installer frameworks (Inno Setup, NSIS, WiX) as malware droppers. The outer binary is benign software with a valid toolchain fingerprint; the payload is
• javascript-obfuscator Commercial-grade JavaScript obfuscation commonly observed in malware droppers. Characterised by string-array lookup tables, control-flow flattening, dead-code injection, and hex-offset string referenc
• legitimate-library-masquerade Cross-family pattern: malware authors clone the identity metadata (copyright, product name, version info, description, company) of a real open-source or commercial library/framework to make their bina
• Legitimate Remote Access Tool Abuse Attackers repackage, re-sign, or reconfigure legitimate remote-access software (ScreenConnect, NetSupport Manager, AnyDesk, TeamViewer) to establish persistent C2 without developing custom malware. Th
• MessagePackLib Asynchronous RAT Protocol A .NET C2 wire-format pattern in which the client and server exchange commands and replies as MessagePack-serialized objects wrapped in an AES-256-HMAC envelope, transported over a TLS-encrypted TCP s
• natural-language-payload-encoding The use of human-readable prose, poetry, or dialogue as a carrier for machine-executable payloads. Instead of encoding binary data as base64, hex, or URL-safe strings, the malware author maps byte val
• netsupport-manager-abuse NetSupport Manager is a legitimate commercial remote-access and classroom-management tool. Threat actors abuse its client installer by bundling it inside masqueraded installers (Inno Setup, IExpress,
• PyArmor Obfuscation PyArmor is a Python obfuscation and licensing toolkit that encrypts Python source code or bytecode and decrypts it at runtime via a compiled C extension (`pyarmor_runtime.pyd`). It is commonly abused
• PyInstaller Bootloader A small C or Win32 PE executable produced by `PyInstaller --onefile`. At runtime it:
• Python-Packed Payload Malware whose executable logic is written in Python, then distributed inside a PE via PyInstaller, py2exe, or cx_Freeze. The outer PE is a benign-language bootloader; the threat logic lives in compile
• ransomware A malware category whose primary **impact** is the encryption, exfiltration, or destruction of files for the purpose of extortion. Traditional ransomware encrypts data in-place, appends a unique exten
• rat — Remote-Access Trojan malware family category A **remote-access trojan (RAT)** is malware that establishes persistent, interactive control over a compromised host, giving the operator the same capabilities as a legitimate remote-administration to
• Raw .NET Metadata Staging A staging technique where a .NET Framework assembly is stored inside another executable not as a complete PE file, but as raw Common Intermediate Language (CIL) bytecode and .NET metadata streams stri
• Reflective PE Loader A position-independent shellcode routine that receives a raw PE file in memory and manually maps it, resolves imports, applies relocations, and transfers execution — all without calling `LoadLibrary`
• Rentry / Pastebin Payload Staging Abuse of text-hosting / paste services (`rentry.co`, `pastebin.com`, `paste.ee`, etc.) as a payload staging layer. Malware authors store obfuscated or partially-obfuscated VBS/BAT/PowerShell snippets
• SMTP Exfiltration Cross-family exfiltration technique: malware sends stolen data as email attachments or body text via hardcoded SMTP credentials. No dedicated C2 infrastructure required — the attacker only needs a dis
• social-engineering-filename-lure The practice of naming a malicious file with a theme that exploits the victim's professional context or urgency — invoices, payments, shipping documents, purchase orders, HR notices, IT updates — to i
• Social Engineering — Purchase Order Masquerade A social-engineering distribution pattern in which malware is packaged with a filename implying a business document — typically `PO`, `Purchase Order`, `INQUIRY`, `QUOTE`, `RFQ`, or `SALES` — often wi
• Stolen Certificate Signing Malware authors re-use or repurpose legitimate TLS/Authenticode certificates stolen from compromised organizations to sign their payloads. This grants the binary a veneer of trust that bypasses "unkno
• telegram-bot-exfiltration — Using the Telegram Bot API as a malware C2 channel The Telegram Bot API (`https://api.telegram.org/bot<TOKEN>`) is used as a C2 and exfiltration channel: malware POSTs victim data (clipboard contents, screenshots, geolocation, system fingerprint) to a
• trif32-caesar-shift-23-decoder A trivial character-shift decoder (Caesar cipher with shift=23, equivalent to ROT-23 or shift backward by 3) embedded in multiple .NET Framework educational applications and games. Named after the cla
• Version Info Masquerade The practice of embedding fabricated or nonsensical `VS_VERSIONINFO` structures in a PE's `.rsrc` section to masquerade as legitimate software. Common in commodity malware, crypters, and loaders. The