http://mattswann.dev/tags/deobfuscation-lab/Recent content in Deobfuscation-Lab on Matt Swann — Detection Engineering & Threat Intelhttp://mattswann.dev/og-image.pnghttp://mattswann.dev/og-image.pngHugoen-usWed, 22 Jul 2026 00:00:00 +0000http://mattswann.dev/posts/quimarat-vbs-dropper/Wed, 22 Jul 2026 00:00:00 +0000http://mattswann.dev/posts/quimarat-vbs-dropper/QuimaRAT is a new RAT being touted as a powerful cross-platform RAT capable of infecting Windows, MacOS, and Linux devices. While this is certainly true, it also happens to be quite an understatement. In this article we will unpack a VBScript dropper and analyze the subsequent JAR payload.http://mattswann.dev/posts/when-comments-arent-comments-obfuscated-javascript/Sun, 12 Jul 2026 00:00:00 +0000http://mattswann.dev/posts/when-comments-arent-comments-obfuscated-javascript/An obfuscated JavaScript sample was observed on a device with an oddly large comment block at the top of the code. Students of programming are often taught that comments are not part of code itself and serve no other purpose other than to provide explanations for code blocks. In this article, we explore why that isn’t always true.http://mattswann.dev/posts/appdomainmanager-injection/Thu, 12 Feb 2026 23:26:36 -0700http://mattswann.dev/posts/appdomainmanager-injection/A deep dive into AppDomainManager injection (T1574.014): how attackers use .NET’s own extensibility model to proxy execution of malicious assemblies through legitimate signed binaries, and what defenders can — and can’t — do about it.http://mattswann.dev/posts/advent-of-cyber-2025-day21-bonus/Sun, 21 Dec 2025 23:39:55 -0700http://mattswann.dev/posts/advent-of-cyber-2025-day21-bonus/A walkthrough of the TryHackMe Advent of Cyber 2025 Day 21 bonus challenge: peeling back a multi-layer HTA payload through VBScript analysis, Base64 decoding, and XOR decryption to uncover a hidden PNG.