https://www.derp.ca/ Original malware analysis, threat intelligence, and security research from the Derp team. en Tue, 14 Jul 2026 12:00:00 GMT https://www.derp.ca/research/artlist-clickfix-native-rat/ https://www.derp.ca/research/artlist-clickfix-native-rat/ Static teardown of a ClickFix chain on new-blog.artlist[.]io, from Polygon EtherHiding and PowerShell delivery to a manually mapped native Windows RAT. Tue, 14 Jul 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/silverfox-panasonic-sauron-loader-chain/ https://www.derp.ca/research/silverfox-panasonic-sauron-loader-chain/ Technical analysis of a SilverFox-style loader chain hiding behind Panasonic PC Notification metadata, using Alibaba OSS carriers, signed side-load hosts, RPC Task Scheduler staging, and a Sauron backdoor. Sun, 21 Jun 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/yuta-solara-roblox-python-rat/ https://www.derp.ca/research/yuta-solara-roblox-python-rat/ Deep-dive analysis of a trojanized Roblox executor that functions as a highly convincing lure with live DeepSeek script generation, while silently staging a Python 3.12 variant of Glove Stealer that bypasses Google Chrome's App-Bound Encryption. Thu, 04 Jun 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/poisonx-windowstelemetry-byovd-rat/ https://www.derp.ca/research/poisonx-windowstelemetry-byovd-rat/ PoisonX WindowsTelemetry chain: VERSION.dll sideloading, BYOVD scheduler, 10FX RAT protocol, SOCKS relay, plugin loading, and C2 reuse across two archives. Tue, 19 May 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/crystalx-go-rat/ https://www.derp.ca/research/crystalx-go-rat/ Static reverse engineering of a 6.9 MB Go RAT delivered through a C stub loader with XOR, ChaCha20, DEFLATE, AES-GCM strings, and WebSocket C2. Mon, 18 May 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/vidar-go-sandbox-dead-drop/ https://www.derp.ca/research/vidar-go-sandbox-dead-drop/ A Go 1.25.4 Vidar v1.5 sample uses a twelve-category sandbox scoring system, Telegram and Steam dead-drop C2 discovery, and process injection APIs. Sat, 16 May 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/eimeria-multi-stage-loader/ https://www.derp.ca/research/eimeria-multi-stage-loader/ Five-layer delivery chain from a RAR5 archive through a signed carrier DLL side-load, AES-CBC hidden in a fake zlib DLL, IExpress extraction, AutoIt process hollowing, and a .NET C2 beacon on WebSocket. Fri, 08 May 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/vect-ransomware-nonce-loss/ https://www.derp.ca/research/vect-ransomware-nonce-loss/ A VECT 2.0 Windows sample can recover small files with a static ChaCha20 key and saved 12-byte nonce, but its large-file path keeps only the final nonce and loses the rest. Sat, 02 May 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/m3rx-ransomware-go-encryptor/ https://www.derp.ca/research/m3rx-ransomware-go-encryptor/ M3rx surfaced with a small leak-site burst and a Go ransomware sample using gzip+gob config data, X25519, AES-CTR file encryption, AES-GCM key wrapping, and a 0x400-byte footer. Mon, 27 Apr 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/kyber-ransomware-hybrid-crypto/ https://www.derp.ca/research/kyber-ransomware-hybrid-crypto/ A Rust Kyber ransomware sample uses AES-256-CTR style file encryption, Kyber1024-sized material, active X25519 arithmetic, and a fixed 0x744 trailer. Sun, 26 Apr 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/urelas-korean-card-game-capture/ https://www.derp.ca/research/urelas-korean-card-game-capture/ A fresh Urelas cluster shows thousands of March-April 2026 samples, Korean ISP command-and-control hosts, a bit-flipped MSMP config, and JPEG capture records built for Korean card-game clients. Sat, 25 Apr 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/trynodeupdate-github-node-bsc-contract-c2/ https://www.derp.ca/research/trynodeupdate-github-node-bsc-contract-c2/ A PowerShell sample installs a GitHub-hosted Node controller, uses a BNB Smart Chain contract to resolve its backend, then hands elevated Windows hosts to a native rpc.exe helper. Fri, 24 Apr 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/qilin-ransomware-teardown/ https://www.derp.ca/research/qilin-ransomware-teardown/ Teardown of the CheckQilin Windows build from 2025's top ransomware crew: BYOVD EDR killer, AES/ChaCha20 dispatch, RSA-OAEP footer, one-byte password bypass. Thu, 09 Apr 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/serpentine-cloud-clickfix-return/ https://www.derp.ca/research/serpentine-cloud-clickfix-return/ Same operator, new delivery chain. ClickFix through Cloudflare tunnels drops five RAT families simultaneously - including Brute Ratel C4 wrapping PureHVNC. Fri, 03 Apr 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/axios-npm-supply-chain-rat/ https://www.derp.ca/research/axios-npm-supply-chain-rat/ Axios 1.14.1 supply chain attack torn apart. XOR dropper deobfuscated, macOS Mach-O decompiled, Windows PowerShell RAT reversed, C2 protocol mapped. Tue, 31 Mar 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/aura-stealer-reverse-engineering/ https://www.derp.ca/research/aura-stealer-reverse-engineering/ Five code obfuscation layers broken, transport encryption reversed, and the full server-pushed config decrypted from a live Aura Stealer C2. Heaven's Gate, CFF, FNV-1a hash tables, and AES-256-CBC. Sat, 28 Mar 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/pay2key-ransomware-crypto-briefing/ https://www.derp.ca/research/pay2key-ransomware-crypto-briefing/ Crypto analysis of a Jan 2026 Pay2Key encryptor. ChaCha20 + Curve25519 via OpenSSL, null nonce, session.tmp on disk. Intermittent mode leaves 70-87% plaintext in large files. Thu, 26 Mar 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/ai-gated-sliver-dropper/ https://www.derp.ca/research/ai-gated-sliver-dropper/ Analysis of a Go binary that sends host telemetry to GPT-4 and only drops its Sliver C2 payload if the model says the environment is safe. We recovered the full system prompt. Wed, 25 Mar 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/interlock-tooling-teardown/ https://www.derp.ca/research/interlock-tooling-teardown/ Static analysis of 15 InterLock samples: ScreenConnect delivery, NodeSnake implants in three languages, a shared crypter, and dual-platform ransomware. Wed, 25 Mar 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/payload-ransomware-babuk-derivative/ https://www.derp.ca/research/payload-ransomware-babuk-derivative/ Full static analysis of the Payload ransomware group. Curve25519 + ChaCha20 encryption, Windows + ESXi builds, 12 victims, 2,603 GB exfiltrated. Sun, 15 Mar 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/hellsuchecker-clickfix-etherhiding/ https://www.derp.ca/research/hellsuchecker-clickfix-etherhiding/ A 10-stage ClickFix chain uses finger.exe, EtherHiding smart contracts, and Hell's Gate syscalls to deliver a memory-resident x64 backdoor. Wed, 11 Mar 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/tranium-wiper-analysis/ https://www.derp.ca/research/tranium-wiper-analysis/ Analysis of Tranium, a Go wiper disguised as ransomware. AES-CBC encryption, MBR overwrite, 30+ system files destroyed, 10 persistence mechanisms, zero payment infrastructure. Tue, 10 Mar 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/ghostweaver-tag124-powershell-rat/ https://www.derp.ca/research/ghostweaver-tag124-powershell-rat/ A TAG-124 fileless PowerShell RAT with 1/76 VT detection. We decoded the wire protocol, four DGA systems, persistence modes, and probed the live C2 server. Sun, 08 Mar 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/fakegit-luajit-github-campaign/ https://www.derp.ca/research/fakegit-luajit-github-campaign/ A Vietnamese operator has run 600+ malicious ZIPs through 47+ GitHub accounts for 13 months. C2 resolves via Polygon smart contract. Final payload is StealC. Wed, 04 Mar 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/ocrfix-etherhiding-botnet/ https://www.derp.ca/research/ocrfix-etherhiding-botnet/ A three-stage VBSEdit botnet uses BSC testnet smart contracts to resolve C2 URLs at runtime. One blockchain transaction rotates every bot to a new domain. Tue, 03 Mar 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/archive-org-stego-campaign/ https://www.derp.ca/research/archive-org-stego-campaign/ An operator hides .NET injector DLLs in 4K wallpaper JPEGs on archive.org, rotating daily across four accounts to deliver Remcos and AsyncRAT. Sat, 28 Feb 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/ironchain-wiper-analysis/ https://www.derp.ca/research/ironchain-wiper-analysis/ Static analysis of IronChain, a Python wiper disguised as ransomware. The RSA-4096 private key is never saved or exfiltrated -- encrypted files are permanently lost. Tue, 24 Feb 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/python-loader-evolution/ https://www.derp.ca/research/python-loader-evolution/ Five generations of Python loader encryption in a 9-RAT campaign: from plaintext RC4 to polymorphic Unicode bytecode, with Donut Chaskey CTR shellcode bridging to .NET. Tue, 24 Feb 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/remcos-autoit-persistence/ https://www.derp.ca/research/remcos-autoit-persistence/ Three AutoIt persistence chains deliver Remcos v7.0.1 Pro for Canadian banking fraud. The third delivers PureHVNC on shared PureLogs C2 infrastructure. Tue, 24 Feb 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/purecrypter-loader-analysis/ https://www.derp.ca/research/purecrypter-loader-analysis/ Technical analysis of PureCrypter, a builder-generated .NET crypter from the PureCoder malware-as-a-service ecosystem, recovered from a multi-stage intrusion tracked as SERPENTINE#CLOUD. Two builds fully reversed. Sun, 22 Feb 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/violet-rat-analysis/ https://www.derp.ca/research/violet-rat-analysis/ Technical analysis of VioletWorm v4.7 (also tracked as Violet RAT) -- a .NET RAT with ransomware, HVNC, USB spreading, crypto clipping, and 120 command branches dispatched through C2-delivered plugin DLLs -- recovered from a multi-stage intrusion with tooling overlap to SERPENTINE#CLOUD. Sun, 22 Feb 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/plog-rat-analysis/ https://www.derp.ca/research/plog-rat-analysis/ Technical analysis of two PureLogs variants from the PureCoder MaaS ecosystem -- a plugin stager and a monolithic crypto-stealing fat client -- recovered from a multi-stage intrusion tracked as SERPENTINE#CLOUD. Sat, 21 Feb 2026 12:00:00 GMT kirk@derp.ca (Kirk) https://www.derp.ca/research/arbitrage-mev-bot-honeypot-scam/ https://www.derp.ca/research/arbitrage-mev-bot-honeypot-scam/ Reverse engineering a fund-draining honeypot smart contract disguised as a MEV arbitrage bot on GitHub, exposing the hidden backdoor and withdrawal mechanism. Mon, 16 Feb 2026 12:00:00 GMT kirk@derp.ca (Kirk)