My solutions and full reverse-engineering writeups for the malware analysis challenges on malops.io — a platform with hands-on RE challenges built around real malware techniques.
Each writeup walks through the analysis question by question: where to look, what the disassembly/decompilation shows, and how the answer is derived. Tools used are mostly IDA Pro, Binary Ninja, and x64dbg.
| # | Challenge | Platform | Category | Difficulty | Description | Writeup |
|---|---|---|---|---|---|---|
| 1 | Singularity | 🐧 Linux | Rootkit | Easy | Linux kernel rootkit that hides PIDs/ports and ships an ICMP-triggered reverse shell | 📄 Read |
| 2 | Kernel Shield | 🪟 Windows | Kernel Driver / EDR Killer | Easy | Driver that strips handle rights and force-kills EDR before ransomware runs | 📄 Read |
| 3 | RokRat Loader | 🪟 Windows | Shellcode Loader (Lazarus / APT) | Medium | XOR loader using PEB-walk API hashing to deploy the RokRat RAT | 📄 Read |
| 4 | EquationDrug | 🪟 Windows | Kernel-Mode Implant | Hard | Memory-only driver doing kernel APC injection into system processes | 📄 Read |
| 5 | Katz Stealer | 🪟 Windows | Infostealer | Medium | Broad stealer grabbing browsers, wallets, and apps, exfil over raw TCP | 📄 Read |
| 6 | Simda | 🪟 Windows | Multi-Stage Loader / Botnet | Hard | Multi-stage packer employing XOR decryption, memory dumping, debugger detection traps, dynamic C2 resolution, and RunOnce persistence | 📄 Read |
| 7 | Carbanak | 🪟 Windows | Banking Trojan / Backdoor | Medium | Banking Trojan using custom API hashing, process injection, encrypted configuration, persistence, and C2 communications for stealthy financial intrusions. | 📄 Read |
| 8 | ShinySpider | 🪟 Windows | Ransomware | Hard | Go-based ransomware featuring ETW evasion, API hashing, privilege checks, mutex-based single-instance protection, shadow copy deletion, lateral movement via SMB/WMI, RSA-OAEP + AES file encryption, anti-forensics, wallpaper modification, and self-deletion mechanisms. | 📄 Read |
| 9 | ValleyRAT | 🪟 Windows | RAT / Backdoor | Medium | Go-based RAT featuring Run-key persistence, AES-encrypted multi-stage payloads, API-hashed shellcode, AMSI/ETW/WLDP security patching, in-memory PE loading, encrypted C2 configuration, process dumping via MiniDumpWriteDump, and multiple C2 ports. | 📄 Read |
| 10 | AuraWiper | 🪟 Windows | Wiper | Easy | Destructive Windows wiper featuring multiple persistence mechanisms, mutex-based execution control, process-monitoring tool termination, Task Manager disabling, MBR overwriting, deletion of critical Windows boot/system files, Shadow Copy and recovery destruction, SeShutdownPrivilege abuse, forced BSOD via NtRaiseHardError, and self-deletion. | 📄 Read |