Malware analysis // how the code works // syscfg.sh
Malwareanalysis
How the code actually works. Loaders, stealers, worms and wipers taken apart - from the 1999 Melissa macro to this year's firmware implants.
Teardowns that trace the mechanism: the C2 handshake, the propagation trick, the persistence the scanner never sees.
// propagationworm modelSPREAD
The track log
what's on file28field reports in this track
159minutes end to end
2024–2026span of events covered
28/28reports with checked sources
Latest in this track
newest firstThe Persistence Layer IR Tools Cannot See: LoJax, CosmicStrand, BlackLotus and What It Takes to Find Firmware-Level Implants
LoJax in 2018, CosmicStrand in 2022, BlackLotus in 2023. Each one survives an OS reinstall, a disk wipe, and a…
Open report →Two Ways Into the Build: ChainDrop's npm Worm, XCSSET v40, and Why Valid Provenance Is Not a Defence
An npm worm in 400+ packages and a macOS infostealer hiding in Xcode projects, four months apart, sharing no code and…
Open report →WannaCry and EternalBlue: How the NSA's Hoarded Exploit Infected 200,000 Machines in 72 Hours
In May 2017, a ransomware worm called WannaCry spread to 200,000 machines across 150 countries in three days. It used…
Open report →The full archive
28 reports // search the stacks28 of 28 reports
01The Persistence Layer IR Tools Cannot See: LoJax, CosmicStrand, BlackLotus and What It Takes to Find Firmware-Level Implants→02Two Ways Into the Build: ChainDrop's npm Worm, XCSSET v40, and Why Valid Provenance Is Not a Defence→03WannaCry and EternalBlue: How the NSA's Hoarded Exploit Infected 200,000 Machines in 72 Hours→04Mirai: How Three College Students Broke the Internet With Default Passwords→05Log4Shell: The CVSS 10.0 Vulnerability Hidden Inside Every Java App→06GameOver Zeus: The $100M Banking Trojan, CryptoLocker, and the Cybercriminal Russia Won't Extradite→07Kaseya and REvil: The Supply Chain Ransomware Attack That Hit 1,500 Businesses on July 4th Weekend→08Conficker: The 15-Million-Machine Botnet That Did Almost Nothing→09Spectre and Meltdown: The CPU Vulnerabilities That Affected Every Computer Since 1995→10Heartbleed: The Vulnerability That Proved Critical Open Source Was Running on Donations→11Carbanak: The $1 Billion Bank Heist That Used APT Techniques for Profit→12Lumma Stealer's C2 Protocol, and What Happened After the May 2025 Takedown→13StealC v2: What Zscaler Actually Found→14Living Off the Land: How LOLBins Get Past EDR→15Atomic Stealer Got Notarized by Apple→16What an XWorm Config Actually Looks Like→17RisePro, Vidar and PrivateLoader: What's Actually Documented→18QakBot and Operation Duck Hunt: 15 Years of Malware, One FBI Uninstaller, and Another Resurrection→19Maze Ransomware and the Invention of Double Extortion→20Emotet: The Malware That Sold Beachheads, the Takedown That Used Its Own Update Channel, and the Resurrection→21CryptoLocker: The Ransomware That Invented the Modern Extortion Model→22The Melissa Worm: How a Word Macro Shut Down Microsoft, Intel, and the US Government's Email in 72 Hours→23ILOVEYOU: The Worm That Infected 45 Million Computers in 10 Hours and Created No Criminals→24Shamoon: The Iranian Wiper That Destroyed 30,000 Saudi Aramco Workstations and Invented State-Sponsored Corporate Destruction→25Code Red: The IIS Worm That Infected 359,000 Servers in 19 Hours and Attacked the White House→26Blaster: The Worm That Attacked Windows Update While Telling Bill Gates to Fix His Software→27Nimda: The Worm That Used Five Propagation Vectors Simultaneously and Became the Internet's Top Threat in 22 Minutes→28SQL Slammer: The 376-Byte Worm That Infected 75,000 Servers in 10 Minutes and Is Still the Fastest Malware Ever→
Track console
shell // guest sessionguest@SYSCFG-MALWAREANA--:--:--
track online // 28 reports indexed
type help, or random.
Try help, random, latest, grep <term>, or count.