QuimaRAT is a new RAT being touted as a powerful cross-platform RAT capable of infecting Windows, MacOS, and Linux devices. While this is certainly true, it also happens to be quite an understatement. In this article we will unpack a VBScript dropper and analyze the subsequent JAR payload.
An obfuscated JavaScript sample was observed on a device with an oddly large comment block at the top of the code. Students of programming are often taught that comments are not part of code itself and serve no other purpose other than to provide explanations for code blocks. In this article, we explore why that isn’t always true.
A deep dive into AppDomainManager injection (T1574.014): how attackers use .NET’s own extensibility model to proxy execution of malicious assemblies through legitimate signed binaries, and what defenders can — and can’t — do about it.
A walkthrough of the TryHackMe Advent of Cyber 2025 Day 21 bonus challenge: peeling back a multi-layer HTA payload through VBScript analysis, Base64 decoding, and XOR decryption to uncover a hidden PNG.