# Derp

> Security research, malware analysis, and threat intelligence.

## Malware Families

- [44 CALIBER](https://www.derp.ca/44_caliber/): 2 days observed, 3 unique C2 hosts
- [751 stealer](https://www.derp.ca/751_stealer/): 0 days observed, 0 unique C2 hosts
- [ACR](https://www.derp.ca/acrstealer/): 2 days observed, 27 unique C2 hosts
- [Acreed Stealer](https://www.derp.ca/acreed_stealer/): 0 days observed, 0 unique C2 hosts
- [Adaptix C2](https://www.derp.ca/adaptix_c2/): 7 days observed, 45 unique C2 hosts
- [Agent Tesla](https://www.derp.ca/agenttesla/): 6 days observed, 22 unique C2 hosts
- [AhMyth](https://www.derp.ca/ahmyth/): 0 days observed, 0 unique C2 hosts
- [AhRat](https://www.derp.ca/ahrat/): 0 days observed, 0 unique C2 hosts
- [Aisuru](https://www.derp.ca/aisuru/): 7 days observed, 26 unique C2 hosts
- [Albiriox](https://www.derp.ca/albiriox/): 1 days observed, 1 unique C2 hosts
- [Amadey](https://www.derp.ca/amadey/): 6 days observed, 33 unique C2 hosts
- [amus](https://www.derp.ca/amus/): 1 days observed, 1 unique C2 hosts
- [AndroRAT](https://www.derp.ca/androrat/): 0 days observed, 0 unique C2 hosts
- [AnimateClipper](https://www.derp.ca/animateclipper/): 6 days observed, 46 unique C2 hosts
- [Anubis](https://www.derp.ca/anubis/): 0 days observed, 0 unique C2 hosts
- [apateweb](https://www.derp.ca/apateweb/): 0 days observed, 0 unique C2 hosts
- [Apollo](https://www.derp.ca/apollo/): 0 days observed, 0 unique C2 hosts
- [AppleSeed](https://www.derp.ca/appleseed/): 0 days observed, 0 unique C2 hosts
- [Arkei](https://www.derp.ca/arkeistealer/): 1 days observed, 1 unique C2 hosts
- [Artemis RAT](https://www.derp.ca/artemisrat/): 0 days observed, 0 unique C2 hosts
- [AsyncRAT](https://www.derp.ca/asyncrat/): 7 days observed, 390 unique C2 hosts
- [Atomic Stealer](https://www.derp.ca/amos/): 1 days observed, 2 unique C2 hosts
- [AuraStealer](https://www.derp.ca/aurastealer/): 0 days observed, 0 unique C2 hosts
- [Aurora Stealer](https://www.derp.ca/aurora/): 0 days observed, 0 unique C2 hosts
- [Azorult](https://www.derp.ca/azorult/): 0 days observed, 0 unique C2 hosts
- [BabylonRAT](https://www.derp.ca/babylonrat/): 0 days observed, 0 unique C2 hosts
- [BADBOX 2.0](https://www.derp.ca/badbox/): 0 days observed, 0 unique C2 hosts
- [bdaejec](https://www.derp.ca/bdaejec/): 4 days observed, 24 unique C2 hosts
- [Beapy](https://www.derp.ca/beapy/): 1 days observed, 2 unique C2 hosts
- [BeaverTail](https://www.derp.ca/beavertail/): 0 days observed, 0 unique C2 hosts
- [Berbew](https://www.derp.ca/berbew/): 2 days observed, 20 unique C2 hosts
- [BianLian](https://www.derp.ca/bianlian/): 1 days observed, 1 unique C2 hosts
- [BitRAT](https://www.derp.ca/bitrat/): 1 days observed, 1 unique C2 hosts
- [BLACKMATTER](https://www.derp.ca/blackmatter/): 5 days observed, 25 unique C2 hosts
- [blacknetrat](https://www.derp.ca/blacknetrat/): 0 days observed, 0 unique C2 hosts
- [blakcseestealer](https://www.derp.ca/blakcseestealer/): 1 days observed, 1 unique C2 hosts
- [BlankGrabber](https://www.derp.ca/blankgrabber/): 4 days observed, 20 unique C2 hosts
- [BlueNoroff](https://www.derp.ca/bluenoroff/): 5 days observed, 0 unique C2 hosts
- [Bobik](https://www.derp.ca/bobik/): 1 days observed, 1 unique C2 hosts
- [bootrepair-sys](https://www.derp.ca/bootrepair_sys/): 1 days observed, 1 unique C2 hosts
- [Brute Ratel C4](https://www.derp.ca/bruteratelc4/): 1 days observed, 2 unique C2 hosts
- [BTMOB](https://www.derp.ca/btmob/): 0 days observed, 0 unique C2 hosts
- [Bumblebee](https://www.derp.ca/bumblebee/): 0 days observed, 0 unique C2 hosts
- [celestialrat](https://www.derp.ca/celestialrat/): 0 days observed, 0 unique C2 hosts
- [chaarlottte](https://www.derp.ca/chaarlottte/): 0 days observed, 0 unique C2 hosts
- [Chaos](https://www.derp.ca/chaos/): 2 days observed, 3 unique C2 hosts
- [chromeb](https://www.derp.ca/chromeb/): 1 days observed, 1 unique C2 hosts
- [clayrat](https://www.derp.ca/clayrat/): 0 days observed, 0 unique C2 hosts
- [ClearFake](https://www.derp.ca/clearfake/): 1 days observed, 0 unique C2 hosts
- [Cobalt Strike](https://www.derp.ca/cobaltstrike/): 7 days observed, 163 unique C2 hosts
- [coffloader](https://www.derp.ca/coffloader/): 2 days observed, 13 unique C2 hosts
- [ConnectBack](https://www.derp.ca/connectback/): 0 days observed, 0 unique C2 hosts
- [Coper](https://www.derp.ca/coper/): 1 days observed, 1 unique C2 hosts
- [Copybara](https://www.derp.ca/copybara/): 1 days observed, 1 unique C2 hosts
- [CORESHELL](https://www.derp.ca/coreshell/): 0 days observed, 0 unique C2 hosts
- [CosmicDuke](https://www.derp.ca/cosmicduke/): 0 days observed, 0 unique C2 hosts
- [CountLoader](https://www.derp.ca/countloader/): 0 days observed, 0 unique C2 hosts
- [CraxsRAT](https://www.derp.ca/craxsrat/): 0 days observed, 0 unique C2 hosts
- [Crimson](https://www.derp.ca/crimson/): 1 days observed, 2 unique C2 hosts
- [CRYPTBOT](https://www.derp.ca/cryptbot/): 0 days observed, 0 unique C2 hosts
- [CryptoLocker](https://www.derp.ca/cryptolocker/): 3 days observed, 7 unique C2 hosts
- [CryptoWall](https://www.derp.ca/cryptowall/): 1 days observed, 1 unique C2 hosts
- [CrySome RAT](https://www.derp.ca/crysome_rat/): 0 days observed, 0 unique C2 hosts
- [CustomerLoader](https://www.derp.ca/customerloader/): 0 days observed, 0 unique C2 hosts
- [cyber_stealer](https://www.derp.ca/cyberstealer/): 0 days observed, 0 unique C2 hosts
- [CyberGate](https://www.derp.ca/cybergate/): 0 days observed, 0 unique C2 hosts
- [DanaBot](https://www.derp.ca/danabot/): 3 days observed, 6 unique C2 hosts
- [DanBot](https://www.derp.ca/danbot/): 0 days observed, 0 unique C2 hosts
- [Darcula](https://www.derp.ca/darcula/): 0 days observed, 0 unique C2 hosts
- [DarkCloud](https://www.derp.ca/darkcloud/): 1 days observed, 1 unique C2 hosts
- [DarkComet](https://www.derp.ca/darkcomet/): 2 days observed, 3 unique C2 hosts
- [DarkGate](https://www.derp.ca/darkgate/): 0 days observed, 0 unique C2 hosts
- [Darkside](https://www.derp.ca/darkside/): 1 days observed, 1 unique C2 hosts
- [darksiderat](https://www.derp.ca/darksiderat/): 2 days observed, 6 unique C2 hosts
- [DarkTortilla](https://www.derp.ca/darktortilla/): 0 days observed, 0 unique C2 hosts
- [DarkVisionRAT](https://www.derp.ca/darkvisionrat/): 1 days observed, 1 unique C2 hosts
- [DarkVNC](https://www.derp.ca/darkvnc/): 0 days observed, 0 unique C2 hosts
- [darthvader](https://www.derp.ca/darthvader/): 0 days observed, 0 unique C2 hosts
- [Datzbro](https://www.derp.ca/datzbro/): 0 days observed, 0 unique C2 hosts
- [DBatLoader](https://www.derp.ca/dbatloader/): 2 days observed, 3 unique C2 hosts
- [DcRAT](https://www.derp.ca/dcrat/): 7 days observed, 44 unique C2 hosts
- [DeerStealer](https://www.derp.ca/deerstealer/): 2 days observed, 3 unique C2 hosts
- [Defendnot](https://www.derp.ca/defendnot/): 3 days observed, 45 unique C2 hosts
- [Deimos](https://www.derp.ca/deimos/): 0 days observed, 0 unique C2 hosts
- [DeimosC2](https://www.derp.ca/deimosc2/): 1 days observed, 1 unique C2 hosts
- [destinystealer](https://www.derp.ca/destinystealer/): 6 days observed, 33 unique C2 hosts
- [Dharma](https://www.derp.ca/dharma/): 1 days observed, 1 unique C2 hosts
- [discordrat](https://www.derp.ca/discordrat/): 4 days observed, 12 unique C2 hosts
- [dkstool](https://www.derp.ca/dkstool/): 0 days observed, 0 unique C2 hosts
- [DorkBot](https://www.derp.ca/dorkbot/): 0 days observed, 0 unique C2 hosts
- [Dosia](https://www.derp.ca/dosia/): 0 days observed, 0 unique C2 hosts
- [draculastealer](https://www.derp.ca/draculastealer/): 4 days observed, 5 unique C2 hosts
- [DragonForce](https://www.derp.ca/dragonforce/): 2 days observed, 3 unique C2 hosts
- [Dridex](https://www.derp.ca/dridex/): 0 days observed, 0 unique C2 hosts
- [drifter](https://www.derp.ca/drifter/): 0 days observed, 0 unique C2 hosts
- [DriveSurge](https://www.derp.ca/drivesurge/): 7 days observed, 35 unique C2 hosts
- [eaglerat](https://www.derp.ca/eaglerat/): 1 days observed, 1 unique C2 hosts
- [Efimer](https://www.derp.ca/efimer/): 0 days observed, 0 unique C2 hosts
- [Emotet](https://www.derp.ca/emotet/): 1 days observed, 1 unique C2 hosts
- [enmity](https://www.derp.ca/enmity/): 0 days observed, 0 unique C2 hosts
- [EtherRAT](https://www.derp.ca/etherrat/): 0 days observed, 0 unique C2 hosts
- [EvilGinx](https://www.derp.ca/evilginx/): 6 days observed, 17 unique C2 hosts
- [EvilTokens](https://www.derp.ca/eviltokens/): 5 days observed, 0 unique C2 hosts
- [evolutionstealer](https://www.derp.ca/evolutionstealer/): 0 days observed, 0 unique C2 hosts
- [Exela Stealer](https://www.derp.ca/exelastealer/): 4 days observed, 5 unique C2 hosts
- [EyePyramid](https://www.derp.ca/eyepyramid/): 2 days observed, 2 unique C2 hosts
- [fadok](https://www.derp.ca/fadok/): 0 days observed, 0 unique C2 hosts
- [FatalRAT](https://www.derp.ca/fatalrat/): 0 days observed, 0 unique C2 hosts
- [FickerStealer](https://www.derp.ca/fickerstealer/): 0 days observed, 0 unique C2 hosts
- [finstealer](https://www.derp.ca/finstealer/): 0 days observed, 0 unique C2 hosts
- [FlawedAmmyy](https://www.derp.ca/flawedammyy/): 2 days observed, 19 unique C2 hosts
- [FleshStealer](https://www.derp.ca/fleshstealer/): 4 days observed, 23 unique C2 hosts
- [FlowerStorm](https://www.derp.ca/flowerstorm/): 6 days observed, 0 unique C2 hosts
- [Floxif](https://www.derp.ca/floxif/): 4 days observed, 31 unique C2 hosts
- [flyingeagle](https://www.derp.ca/flyingeagle/): 0 days observed, 0 unique C2 hosts
- [Forg365](https://www.derp.ca/forg365/): 0 days observed, 0 unique C2 hosts
- [futurax](https://www.derp.ca/futurax/): 0 days observed, 0 unique C2 hosts
- [Gafgyt](https://www.derp.ca/bashlite/): 1 days observed, 0 unique C2 hosts
- [galaxyrat](https://www.derp.ca/galaxyrat/): 0 days observed, 0 unique C2 hosts
- [GandCrab](https://www.derp.ca/gandcrab/): 0 days observed, 0 unique C2 hosts
- [Gcleaner](https://www.derp.ca/gcleaner/): 4 days observed, 10 unique C2 hosts
- [Gcore](https://www.derp.ca/gcore/): 5 days observed, 0 unique C2 hosts
- [gh0st RAT](https://www.derp.ca/gh0strat/): 7 days observed, 84 unique C2 hosts
- [GhostGrab](https://www.derp.ca/ghostgrab/): 0 days observed, 0 unique C2 hosts
- [GhostLocker](https://www.derp.ca/ghostlocker/): 0 days observed, 0 unique C2 hosts
- [GhostSocks](https://www.derp.ca/ghostsocks/): 3 days observed, 11 unique C2 hosts
- [GigaWiper](https://www.derp.ca/gigawiper/): 0 days observed, 0 unique C2 hosts
- [glamour](https://www.derp.ca/glamour/): 1 days observed, 1 unique C2 hosts
- [Glupteba](https://www.derp.ca/glupteba/): 1 days observed, 2 unique C2 hosts
- [Godzilla Webshell](https://www.derp.ca/godzilla_webshell/): 0 days observed, 0 unique C2 hosts
- [GootKit](https://www.derp.ca/gootkit/): 0 days observed, 0 unique C2 hosts
- [gosteal](https://www.derp.ca/gosteal/): 0 days observed, 0 unique C2 hosts
- [GravityRAT](https://www.derp.ca/gravityrat/): 0 days observed, 0 unique C2 hosts
- [grenam](https://www.derp.ca/grenam/): 1 days observed, 1 unique C2 hosts
- [Grunt](https://www.derp.ca/grunt/): 0 days observed, 0 unique C2 hosts
- [Guerrilla](https://www.derp.ca/guerrilla/): 0 days observed, 0 unique C2 hosts
- [GuLoader](https://www.derp.ca/guloader/): 5 days observed, 8 unique C2 hosts
- [gurcu](https://www.derp.ca/gurcu/): 4 days observed, 14 unique C2 hosts
- [HackBrowserData](https://www.derp.ca/hackbrowserdata/): 4 days observed, 5 unique C2 hosts
- [HanGhost](https://www.derp.ca/hanghost/): 0 days observed, 0 unique C2 hosts
- [Havoc](https://www.derp.ca/havoc/): 6 days observed, 10 unique C2 hosts
- [HawkEye](https://www.derp.ca/hawkeyekeylogger/): 1 days observed, 1 unique C2 hosts
- [healer](https://www.derp.ca/healer/): 1 days observed, 1 unique C2 hosts
- [HiddenTear](https://www.derp.ca/hiddentear/): 2 days observed, 3 unique C2 hosts
- [HijackLoader](https://www.derp.ca/hijackloader/): 4 days observed, 17 unique C2 hosts
- [Hive](https://www.derp.ca/hive/): 2 days observed, 18 unique C2 hosts
- [honeystorm](https://www.derp.ca/honeystorm/): 7 days observed, 0 unique C2 hosts
- [HOOK](https://www.derp.ca/hook/): 0 days observed, 0 unique C2 hosts
- [Houdini](https://www.derp.ca/houdini/): 1 days observed, 2 unique C2 hosts
- [Hupigon](https://www.derp.ca/hupigon/): 0 days observed, 0 unique C2 hosts
- [Hydra](https://www.derp.ca/hydra/): 0 days observed, 0 unique C2 hosts
- [IcedID](https://www.derp.ca/icedid/): 0 days observed, 0 unique C2 hosts
- [infinitylock](https://www.derp.ca/infinitylock/): 1 days observed, 1 unique C2 hosts
- [InvisibleFerret](https://www.derp.ca/invisibleferret/): 0 days observed, 0 unique C2 hosts
- [Irata](https://www.derp.ca/irata/): 0 days observed, 0 unique C2 hosts
- [jackskid](https://www.derp.ca/jackskid/): 0 days observed, 0 unique C2 hosts
- [Jalisco](https://www.derp.ca/jalisco/): 0 days observed, 0 unique C2 hosts
- [jeefo](https://www.derp.ca/jeefo/): 1 days observed, 1 unique C2 hosts
- [Jigsaw](https://www.derp.ca/jigsaw/): 4 days observed, 6 unique C2 hosts
- [jlocker](https://www.derp.ca/jlocker/): 2 days observed, 3 unique C2 hosts
- [jRAT](https://www.derp.ca/adwind/): 1 days observed, 1 unique C2 hosts
- [juko](https://www.derp.ca/juko/): 4 days observed, 6 unique C2 hosts
- [Kaiji](https://www.derp.ca/kaiji/): 1 days observed, 1 unique C2 hosts
- [Kaiten](https://www.derp.ca/kaiten/): 1 days observed, 0 unique C2 hosts
- [Kali365](https://www.derp.ca/kali365/): 7 days observed, 11 unique C2 hosts
- [Kalim](https://www.derp.ca/kalim/): 1 days observed, 1 unique C2 hosts
- [Kimwolf](https://www.derp.ca/kimwolf/): 1 days observed, 10 unique C2 hosts
- [Kinsing](https://www.derp.ca/kinsing/): 0 days observed, 0 unique C2 hosts
- [Koi Loader](https://www.derp.ca/koiloader/): 6 days observed, 18 unique C2 hosts
- [Konfety](https://www.derp.ca/konfety/): 0 days observed, 0 unique C2 hosts
- [Kongtuke](https://www.derp.ca/kongtuke/): 7 days observed, 0 unique C2 hosts
- [Kratos](https://www.derp.ca/kratos/): 1 days observed, 0 unique C2 hosts
- [kutaki](https://www.derp.ca/kutaki/): 0 days observed, 0 unique C2 hosts
- [la02loader](https://www.derp.ca/la02loader/): 4 days observed, 2 unique C2 hosts
- [Laplas](https://www.derp.ca/laplas/): 1 days observed, 1 unique C2 hosts
- [LATENTBOT](https://www.derp.ca/latentbot/): 0 days observed, 0 unique C2 hosts
- [Latrodectus](https://www.derp.ca/latrodectus/): 1 days observed, 1 unique C2 hosts
- [lissac2](https://www.derp.ca/lissac2/): 0 days observed, 0 unique C2 hosts
- [LittleDaemon](https://www.derp.ca/littledaemon/): 1 days observed, 1 unique C2 hosts
- [LockBit](https://www.derp.ca/lockbit/): 5 days observed, 28 unique C2 hosts
- [Locky](https://www.derp.ca/locky/): 0 days observed, 0 unique C2 hosts
- [LodaRAT](https://www.derp.ca/lodarat/): 1 days observed, 1 unique C2 hosts
- [Lokibot](https://www.derp.ca/lokibot/): 2 days observed, 2 unique C2 hosts
- [LOTUSLITE](https://www.derp.ca/lotuslite/): 0 days observed, 0 unique C2 hosts
- [Lumma Stealer](https://www.derp.ca/lumma/): 6 days observed, 32 unique C2 hosts
- [Luna](https://www.derp.ca/luna/): 0 days observed, 0 unique C2 hosts
- [lxbaserat](https://www.derp.ca/lxbaserat/): 3 days observed, 9 unique C2 hosts
- [MageCart](https://www.derp.ca/magecart/): 0 days observed, 0 unique C2 hosts
- [Mamba2FA](https://www.derp.ca/mamba2fa/): 2 days observed, 0 unique C2 hosts
- [Mars Stealer](https://www.derp.ca/marsstealer/): 0 days observed, 0 unique C2 hosts
- [maskgramstealer](https://www.derp.ca/maskgramstealer/): 1 days observed, 1 unique C2 hosts
- [Masslogger](https://www.derp.ca/masslogger/): 4 days observed, 9 unique C2 hosts
- [Matanbuchus](https://www.derp.ca/matanbuchus/): 0 days observed, 0 unique C2 hosts
- [MatIEx](https://www.derp.ca/matiex/): 0 days observed, 0 unique C2 hosts
- [Meduza](https://www.derp.ca/meduza/): 0 days observed, 0 unique C2 hosts
- [Metasploit](https://www.derp.ca/metasploit/): 5 days observed, 53 unique C2 hosts
- [MetaStealer](https://www.derp.ca/metastealer/): 0 days observed, 0 unique C2 hosts
- [miarroba](https://www.derp.ca/miarroba/): 7 days observed, 0 unique C2 hosts
- [millenniumrat](https://www.derp.ca/millenniumrat/): 1 days observed, 1 unique C2 hosts
- [Mimikatz](https://www.derp.ca/mimikatz/): 5 days observed, 8 unique C2 hosts
- [MintsLoader](https://www.derp.ca/mintsloader/): 0 days observed, 0 unique C2 hosts
- [Mirai](https://www.derp.ca/mirai/): 7 days observed, 138 unique C2 hosts
- [Mispadu](https://www.derp.ca/mispadu/): 0 days observed, 0 unique C2 hosts
- [mofongoloader](https://www.derp.ca/mofongoloader/): 0 days observed, 0 unique C2 hosts
- [monsterv2](https://www.derp.ca/monsterv2/): 1 days observed, 1 unique C2 hosts
- [MooBot](https://www.derp.ca/moobot/): 0 days observed, 0 unique C2 hosts
- [moonrise](https://www.derp.ca/moonrise/): 0 days observed, 0 unique C2 hosts
- [Mozi](https://www.derp.ca/mozi/): 4 days observed, 0 unique C2 hosts
- [msduck stealer](https://www.derp.ca/msduck_stealer/): 0 days observed, 0 unique C2 hosts
- [MyDoom](https://www.derp.ca/mydoom/): 0 days observed, 0 unique C2 hosts
- [myhone69](https://www.derp.ca/myhone69/): 0 days observed, 0 unique C2 hosts
- [MyloBot](https://www.derp.ca/mylobot/): 0 days observed, 0 unique C2 hosts
- [N-W0rm](https://www.derp.ca/nworm/): 1 days observed, 2 unique C2 hosts
- [nabucur](https://www.derp.ca/nabucur/): 2 days observed, 4 unique C2 hosts
- [NakedPages](https://www.derp.ca/nakedpages/): 0 days observed, 0 unique C2 hosts
- [NanoCore](https://www.derp.ca/nanocore/): 7 days observed, 206 unique C2 hosts
- [Neconyd](https://www.derp.ca/neconyd/): 1 days observed, 3 unique C2 hosts
- [Needle Stealer](https://www.derp.ca/needlestealer/): 0 days observed, 0 unique C2 hosts
- [Nemucod](https://www.derp.ca/nemucod/): 1 days observed, 1 unique C2 hosts
- [Neptune RAT](https://www.derp.ca/neptunerat/): 5 days observed, 17 unique C2 hosts
- [Neshta](https://www.derp.ca/neshta/): 4 days observed, 4 unique C2 hosts
- [netreactor](https://www.derp.ca/netreactor/): 2 days observed, 4 unique C2 hosts
- [NetSupport RAT](https://www.derp.ca/netsupportmanagerrat/): 5 days observed, 21 unique C2 hosts
- [NETWIRE](https://www.derp.ca/netwire/): 2 days observed, 3 unique C2 hosts
- [NetWorm](https://www.derp.ca/networm/): 1 days observed, 1 unique C2 hosts
- [nexuswin](https://www.derp.ca/nexuswin/): 0 days observed, 0 unique C2 hosts
- [Ngioweb](https://www.derp.ca/ngioweb/): 0 days observed, 0 unique C2 hosts
- [NightHawk](https://www.derp.ca/nighthawk/): 0 days observed, 0 unique C2 hosts
- [NightshadeC2](https://www.derp.ca/nightshadec2/): 1 days observed, 0 unique C2 hosts
- [njRAT](https://www.derp.ca/njrat/): 6 days observed, 41 unique C2 hosts
- [NoEscape](https://www.derp.ca/noescape/): 1 days observed, 1 unique C2 hosts
- [NonEuclid RAT](https://www.derp.ca/noneuclidrat/): 5 days observed, 26 unique C2 hosts
- [NullMixer](https://www.derp.ca/nullmixer/): 0 days observed, 0 unique C2 hosts
- [octagon](https://www.derp.ca/octagon/): 0 days observed, 0 unique C2 hosts
- [OmegaLord](https://www.derp.ca/omegalord/): 0 days observed, 0 unique C2 hosts
- [onlylogger](https://www.derp.ca/onlylogger/): 1 days observed, 1 unique C2 hosts
- [OnyxC2](https://www.derp.ca/onyxc2/): 0 days observed, 0 unique C2 hosts
- [OrcusRAT](https://www.derp.ca/orcusrat/): 0 days observed, 0 unique C2 hosts
- [Oski](https://www.derp.ca/oski/): 0 days observed, 0 unique C2 hosts
- [otpstealer](https://www.derp.ca/otpstealer/): 0 days observed, 0 unique C2 hosts
- [overlayrat](https://www.derp.ca/overlayrat/): 1 days observed, 1 unique C2 hosts
- [Overlord](https://www.derp.ca/overlord/): 7 days observed, 27 unique C2 hosts
- [OVERWATCH](https://www.derp.ca/overwatch/): 0 days observed, 0 unique C2 hosts
- [Panda Stealer](https://www.derp.ca/pandastealer/): 0 days observed, 0 unique C2 hosts
- [Pay2Key](https://www.derp.ca/pay2key/): 0 days observed, 0 unique C2 hosts
- [Pentagon Stealer](https://www.derp.ca/pentagonstealer/): 0 days observed, 0 unique C2 hosts
- [phantomgate](https://www.derp.ca/phantomgate/): 1 days observed, 1 unique C2 hosts
- [PhantomStealer](https://www.derp.ca/phantomstealer/): 7 days observed, 18 unique C2 hosts
- [Phoenix](https://www.derp.ca/phoenix/): 0 days observed, 0 unique C2 hosts
- [Phorpiex](https://www.derp.ca/phorpiex/): 6 days observed, 39 unique C2 hosts
- [Pikabot](https://www.derp.ca/pikabot/): 0 days observed, 0 unique C2 hosts
- [PipeMagic](https://www.derp.ca/pipemagic/): 0 days observed, 0 unique C2 hosts
- [Pony](https://www.derp.ca/pony/): 1 days observed, 2 unique C2 hosts
- [Poseidon](https://www.derp.ca/poseidon/): 0 days observed, 0 unique C2 hosts
- [PoshC2](https://www.derp.ca/poshc2/): 0 days observed, 0 unique C2 hosts
- [predator](https://www.derp.ca/predator/): 0 days observed, 0 unique C2 hosts
- [PrivateLoader](https://www.derp.ca/privateloader/): 1 days observed, 20 unique C2 hosts
- [Pupy](https://www.derp.ca/pupy/): 0 days observed, 0 unique C2 hosts
- [PureLogs](https://www.derp.ca/purelogs/): 2 days observed, 11 unique C2 hosts
- [PureRAT](https://www.derp.ca/purerat/): 7 days observed, 69 unique C2 hosts
- [PurpleFox](https://www.derp.ca/purplefox/): 4 days observed, 14 unique C2 hosts
- [pykspa](https://www.derp.ca/pykspa/): 1 days observed, 4 unique C2 hosts
- [Python stealer](https://www.derp.ca/pythonstealer/): 1 days observed, 1 unique C2 hosts
- [QakBot](https://www.derp.ca/qakbot/): 0 days observed, 0 unique C2 hosts
- [qnodeservice](https://www.derp.ca/qnodeservice/): 0 days observed, 0 unique C2 hosts
- [qqpass](https://www.derp.ca/qqpass/): 0 days observed, 0 unique C2 hosts
- [qtr_stealer](https://www.derp.ca/qtr_stealer/): 1 days observed, 1 unique C2 hosts
- [QuasarRAT](https://www.derp.ca/quasar/): 7 days observed, 113 unique C2 hosts
- [Raccoon Stealer](https://www.derp.ca/raccoon/): 1 days observed, 2 unique C2 hosts
- [Ramnit](https://www.derp.ca/ramnit/): 2 days observed, 29 unique C2 hosts
- [RapidStealer](https://www.derp.ca/rapidstealer/): 0 days observed, 0 unique C2 hosts
- [RATel](https://www.derp.ca/ratel/): 0 days observed, 0 unique C2 hosts
- [RatonRAT](https://www.derp.ca/ratonrat/): 7 days observed, 42 unique C2 hosts
- [RAWorld](https://www.derp.ca/raworld/): 2 days observed, 3 unique C2 hosts
- [RedLine](https://www.derp.ca/redline/): 5 days observed, 47 unique C2 hosts
- [Redosdru](https://www.derp.ca/redosdru/): 6 days observed, 17 unique C2 hosts
- [Redtail](https://www.derp.ca/redtail/): 1 days observed, 0 unique C2 hosts
- [RemCom](https://www.derp.ca/remcom/): 0 days observed, 0 unique C2 hosts
- [Remcos](https://www.derp.ca/remcos/): 7 days observed, 183 unique C2 hosts
- [Remo](https://www.derp.ca/remo/): 0 days observed, 0 unique C2 hosts
- [remotex](https://www.derp.ca/remotex/): 0 days observed, 0 unique C2 hosts
- [Remus](https://www.derp.ca/remus/): 7 days observed, 124 unique C2 hosts
- [RevengeRAT](https://www.derp.ca/revengerat/): 2 days observed, 7 unique C2 hosts
- [REvil](https://www.derp.ca/revil/): 2 days observed, 12 unique C2 hosts
- [Rhadamanthys](https://www.derp.ca/rhadamanthys/): 0 days observed, 0 unique C2 hosts
- [RisePro](https://www.derp.ca/risepro/): 4 days observed, 17 unique C2 hosts
- [RMS](https://www.derp.ca/rms/): 0 days observed, 0 unique C2 hosts
- [Rockstar2FA](https://www.derp.ca/rockstar2fa/): 0 days observed, 0 unique C2 hosts
- [ROKRAT](https://www.derp.ca/rokrat/): 2 days observed, 4 unique C2 hosts
- [RunningRAT](https://www.derp.ca/runningrat/): 0 days observed, 0 unique C2 hosts
- [rustme](https://www.derp.ca/rustme/): 5 days observed, 13 unique C2 hosts
- [Rustonotto](https://www.derp.ca/rustonotto/): 1 days observed, 1 unique C2 hosts
- [RustyStealer](https://www.derp.ca/rustystealer/): 1 days observed, 1 unique C2 hosts
- [Sakula](https://www.derp.ca/sakularat/): 2 days observed, 2 unique C2 hosts
- [SALATSTEALER](https://www.derp.ca/salatstealer/): 7 days observed, 42 unique C2 hosts
- [Sality](https://www.derp.ca/sality/): 3 days observed, 5 unique C2 hosts
- [SantaStealer](https://www.derp.ca/santastealer/): 1 days observed, 1 unique C2 hosts
- [SectopRAT](https://www.derp.ca/sectoprat/): 5 days observed, 13 unique C2 hosts
- [servstart](https://www.derp.ca/servstart/): 0 days observed, 0 unique C2 hosts
- [SessionSerpent](https://www.derp.ca/sessionserpent/): 7 days observed, 0 unique C2 hosts
- [seven](https://www.derp.ca/seven/): 1 days observed, 1 unique C2 hosts
- [Shade](https://www.derp.ca/troldesh/): 4 days observed, 18 unique C2 hosts
- [SharkBot](https://www.derp.ca/sharkbot/): 1 days observed, 1 unique C2 hosts
- [SharpHound](https://www.derp.ca/sharphound/): 6 days observed, 45 unique C2 hosts
- [shkv](https://www.derp.ca/shkv/): 0 days observed, 0 unique C2 hosts
- [SilverFox](https://www.derp.ca/silverfox/): 2 days observed, 12 unique C2 hosts
- [SilverRAT](https://www.derp.ca/silverrat/): 0 days observed, 0 unique C2 hosts
- [siriusrat](https://www.derp.ca/siriusrat/): 7 days observed, 20 unique C2 hosts
- [Sistema](https://www.derp.ca/sistema/): 0 days observed, 0 unique C2 hosts
- [Skuld](https://www.derp.ca/skuld/): 1 days observed, 1 unique C2 hosts
- [skyw4lker](https://www.derp.ca/skyw4lker/): 0 days observed, 0 unique C2 hosts
- [Sliver](https://www.derp.ca/sliver/): 5 days observed, 8 unique C2 hosts
- [SmartLoader](https://www.derp.ca/smartloader/): 1 days observed, 2 unique C2 hosts
- [SMOKELOADER](https://www.derp.ca/smokeloader/): 2 days observed, 5 unique C2 hosts
- [SnakeKeylogger](https://www.derp.ca/snakekeylogger/): 0 days observed, 0 unique C2 hosts
- [SnappyClient](https://www.derp.ca/snappyclient/): 2 days observed, 3 unique C2 hosts
- [Sneaky2FA](https://www.derp.ca/sneaky2fa/): 3 days observed, 0 unique C2 hosts
- [Snojan](https://www.derp.ca/snojan/): 1 days observed, 1 unique C2 hosts
- [Socelars](https://www.derp.ca/socelars/): 0 days observed, 0 unique C2 hosts
- [SocGholish](https://www.derp.ca/socgholish/): 7 days observed, 0 unique C2 hosts
- [Socks5Systemz](https://www.derp.ca/socks5systemz/): 2 days observed, 5 unique C2 hosts
- [SolarisLoader](https://www.derp.ca/solarisloader/): 3 days observed, 11 unique C2 hosts
- [specter_stealer](https://www.derp.ca/specter_stealer/): 1 days observed, 1 unique C2 hosts
- [Spica](https://www.derp.ca/spica/): 0 days observed, 0 unique C2 hosts
- [SpyNote](https://www.derp.ca/spynote/): 2 days observed, 2 unique C2 hosts
- [StealC](https://www.derp.ca/stealc/): 6 days observed, 75 unique C2 hosts
- [Stealerium](https://www.derp.ca/stealerium/): 3 days observed, 7 unique C2 hosts
- [StealthWorker](https://www.derp.ca/stealthworker/): 1 days observed, 0 unique C2 hosts
- [Stop](https://www.derp.ca/stop/): 2 days observed, 2 unique C2 hosts
- [StormKitty](https://www.derp.ca/cameleon/): 4 days observed, 7 unique C2 hosts
- [stormser](https://www.derp.ca/stormser/): 0 days observed, 0 unique C2 hosts
- [STRRAT](https://www.derp.ca/strrat/): 1 days observed, 1 unique C2 hosts
- [SVCStealer](https://www.derp.ca/svcstealer/): 5 days observed, 35 unique C2 hosts
- [SYSTEMBC](https://www.derp.ca/systembc/): 0 days observed, 0 unique C2 hosts
- [systex](https://www.derp.ca/systex/): 0 days observed, 0 unique C2 hosts
- [TAG-150](https://www.derp.ca/tag_150/): 3 days observed, 1 unique C2 hosts
- [TangleBot](https://www.derp.ca/tanglebot/): 1 days observed, 1 unique C2 hosts
- [TeamTNT](https://www.derp.ca/teamtnt/): 0 days observed, 0 unique C2 hosts
- [Termite](https://www.derp.ca/termite/): 0 days observed, 0 unique C2 hosts
- [TernDoor](https://www.derp.ca/terndoor/): 0 days observed, 0 unique C2 hosts
- [TinyNuke](https://www.derp.ca/tinynuke/): 1 days observed, 1 unique C2 hosts
- [Tofsee](https://www.derp.ca/tofsee/): 3 days observed, 6 unique C2 hosts
- [Triada](https://www.derp.ca/triada/): 0 days observed, 0 unique C2 hosts
- [TrickBot](https://www.derp.ca/trickbot/): 0 days observed, 0 unique C2 hosts
- [Tsunami](https://www.derp.ca/tsunami/): 0 days observed, 0 unique C2 hosts
- [Tsundere](https://www.derp.ca/tsundere/): 2 days observed, 3 unique C2 hosts
- [UmbralStealer](https://www.derp.ca/umbral/): 4 days observed, 9 unique C2 hosts
- [unixstealer](https://www.derp.ca/unixstealer/): 0 days observed, 0 unique C2 hosts
- [Urelas](https://www.derp.ca/urelas/): 3 days observed, 10 unique C2 hosts
- [URSNIF](https://www.derp.ca/gozi/): 2 days observed, 2 unique C2 hosts
- [ValleyRAT](https://www.derp.ca/valleyrat/): 7 days observed, 49 unique C2 hosts
- [VanillaRAT](https://www.derp.ca/vanillarat/): 0 days observed, 0 unique C2 hosts
- [vaulttoken](https://www.derp.ca/vaulttoken/): 0 days observed, 0 unique C2 hosts
- [vbrevshell](https://www.derp.ca/vbrevshell/): 1 days observed, 1 unique C2 hosts
- [vertexnet](https://www.derp.ca/vertexnet/): 2 days observed, 4 unique C2 hosts
- [Vidar](https://www.derp.ca/vidar/): 7 days observed, 96 unique C2 hosts
- [Violet](https://www.derp.ca/violetrat/): 1 days observed, 1 unique C2 hosts
- [VIPKeylogger](https://www.derp.ca/vipkeylogger/): 5 days observed, 16 unique C2 hosts
- [Vjw0rm](https://www.derp.ca/vjw0rm/): 2 days observed, 30 unique C2 hosts
- [Vo1d](https://www.derp.ca/vo1d/): 0 days observed, 0 unique C2 hosts
- [vryxen](https://www.derp.ca/vryxen/): 1 days observed, 1 unique C2 hosts
- [VShell](https://www.derp.ca/vshell/): 7 days observed, 83 unique C2 hosts
- [vuln-driver](https://www.derp.ca/vuln_driver/): 1 days observed, 1 unique C2 hosts
- [WannaCryptor](https://www.derp.ca/wannacryptor/): 7 days observed, 90 unique C2 hosts
- [WarmCookie](https://www.derp.ca/warmcookie/): 1 days observed, 2 unique C2 hosts
- [WarzoneRAT](https://www.derp.ca/warzone/): 5 days observed, 11 unique C2 hosts
- [waski](https://www.derp.ca/waski/): 2 days observed, 3 unique C2 hosts
- [WhiteSnake](https://www.derp.ca/whitesnake/): 1 days observed, 1 unique C2 hosts
- [win.xenorat](https://www.derp.ca/win_xenorat/): 1 days observed, 1 unique C2 hosts
- [XenoRAT](https://www.derp.ca/xenorat/): 1 days observed, 2 unique C2 hosts
- [XLoader](https://www.derp.ca/xloader/): 6 days observed, 66 unique C2 hosts
- [XMRig](https://www.derp.ca/xmrig/): 7 days observed, 97 unique C2 hosts
- [XorDDoS](https://www.derp.ca/xorddos/): 1 days observed, 0 unique C2 hosts
- [Xorist](https://www.derp.ca/xorist/): 2 days observed, 3 unique C2 hosts
- [xorium_stealer](https://www.derp.ca/xorium_stealer/): 2 days observed, 2 unique C2 hosts
- [XpertRAT](https://www.derp.ca/xpertrat/): 0 days observed, 0 unique C2 hosts
- [Xred](https://www.derp.ca/xred/): 7 days observed, 127 unique C2 hosts
- [XTinyLoader](https://www.derp.ca/xtinyloader/): 2 days observed, 4 unique C2 hosts
- [Xtreme RAT](https://www.derp.ca/extremerat/): 0 days observed, 0 unique C2 hosts
- [XWorm](https://www.derp.ca/xworm/): 7 days observed, 216 unique C2 hosts
- [zgRAT](https://www.derp.ca/zgrat/): 0 days observed, 0 unique C2 hosts
- [ZLoader](https://www.derp.ca/zloader/): 0 days observed, 0 unique C2 hosts
- [ZPHP](https://www.derp.ca/smartapesg/): 7 days observed, 1 unique C2 hosts

## Research

- [1,509 WordPress sites feed an active SocGholish chain](https://www.derp.ca/research/ta2726-wordpress-malware-launchpads/): One integrated WordPress-to-GhoLoader operation mapped to Proofpoint's TA2726 and TA569/SocGholish labels, followed by ClickFix on shared hosts.
- [From EtherHiding to a native RAT: ClickFix on new-blog.artlist[.]io](https://www.derp.ca/research/artlist-clickfix-native-rat/): Static teardown of a ClickFix chain on new-blog.artlist[.]io, from Polygon EtherHiding and PowerShell delivery to a manually mapped native Windows RAT.
- [SilverFox-style loader chain: Panasonic shells, Alibaba OSS carriers, and a Sauron backdoor](https://www.derp.ca/research/silverfox-panasonic-sauron-loader-chain/): Technical analysis of a SilverFox-style loader chain hiding behind Panasonic PC Notification metadata, using Alibaba OSS carriers, signed side-load hosts, RPC Task Scheduler staging, and a Sauron backdoor.
- [AI-Powered Cheats & Stolen Secrets: Teardown of the Yuta/Solara Roblox Stealer](https://www.derp.ca/research/yuta-solara-roblox-python-rat/): Deep-dive analysis of a trojanized Roblox executor that functions as a highly convincing lure with live DeepSeek script generation, while silently staging a Python 3.12 variant of Glove Stealer that bypasses Google Chrome's App-Bound Encryption.
- [PoisonX WindowsTelemetry: BYOVD-Assisted RAT With a Plugin Loader](https://www.derp.ca/research/poisonx-windowstelemetry-byovd-rat/): PoisonX WindowsTelemetry chain: VERSION.dll sideloading, BYOVD scheduler, 10FX RAT protocol, SOCKS relay, plugin loading, and C2 reuse across two archives.
- [CrystalX: unpacking a Go RAT through three encrypted layers](https://www.derp.ca/research/crystalx-go-rat/): Static reverse engineering of a 6.9 MB Go RAT delivered through a C stub loader with XOR, ChaCha20, DEFLATE, AES-GCM strings, and WebSocket C2.
- [Vidar v1.5 in Go: same family, new language, heavy sandbox checks](https://www.derp.ca/research/vidar-go-sandbox-dead-drop/): A Go 1.25.4 Vidar v1.5 sample uses a twelve-category sandbox scoring system, Telegram and Steam dead-drop C2 discovery, and process injection APIs.
- [Eimeria: five layers from RAR5 to RunPE](https://www.derp.ca/research/eimeria-multi-stage-loader/): Five-layer delivery chain from a RAR5 archive through a signed carrier DLL side-load, AES-CBC hidden in a fake zlib DLL, IExpress extraction, AutoIt process hollowing, and a .NET C2 beacon on WebSocket.
- [VECT ransomware: small files decrypt, large files lose their nonces](https://www.derp.ca/research/vect-ransomware-nonce-loss/): A VECT 2.0 Windows sample can recover small files with a static ChaCha20 key and saved 12-byte nonce, but its large-file path keeps only the final nonce and loses the rest.
- [M3rx ransomware: inside a new leak-site actor and Go encryptor](https://www.derp.ca/research/m3rx-ransomware-go-encryptor/): M3rx surfaced with a small leak-site burst and a Go ransomware sample using gzip+gob config data, X25519, AES-CTR file encryption, AES-GCM key wrapping, and a 0x400-byte footer.
- [Kyber ransomware is not just post-quantum name-dropping](https://www.derp.ca/research/kyber-ransomware-hybrid-crypto/): A Rust Kyber ransomware sample uses AES-256-CTR style file encryption, Kyber1024-sized material, active X25519 arithmetic, and a fixed 0x744 trailer.
- [Urelas is old, weird, and still watching Korean card games](https://www.derp.ca/research/urelas-korean-card-game-capture/): A fresh Urelas cluster shows thousands of March-April 2026 samples, Korean ISP command-and-control hosts, a bit-flipped MSMP config, and JPEG capture records built for Korean card-game clients.
- [TryNodeUpdate turns GitHub and BSC into a TCP control lane](https://www.derp.ca/research/trynodeupdate-github-node-bsc-contract-c2/): A PowerShell sample installs a GitHub-hosted Node controller, uses a BNB Smart Chain contract to resolve its backend, then hands elevated Windows hosts to a native rpc.exe helper.
- [Qilin: inside the Windows ransomware build behind 1,000+ victims](https://www.derp.ca/research/qilin-ransomware-teardown/): Teardown of the CheckQilin Windows build from 2025's top ransomware crew: BYOVD EDR killer, AES/ChaCha20 dispatch, RSA-OAEP footer, one-byte password bypass.
- [SERPENTINE#CLOUD returns: ClickFix lure drops five RATs](https://www.derp.ca/research/serpentine-cloud-clickfix-return/): Same operator, new delivery chain. ClickFix through Cloudflare tunnels drops five RAT families simultaneously - including Brute Ratel C4 wrapping PureHVNC.
- [Axios npm compromise: XOR dropper to cross-platform RAT](https://www.derp.ca/research/axios-npm-supply-chain-rat/): Axios 1.14.1 supply chain attack torn apart. XOR dropper deobfuscated, macOS Mach-O decompiled, Windows PowerShell RAT reversed, C2 protocol mapped.
- [Breaking Aura: five obfuscation layers & hates sandboxes](https://www.derp.ca/research/aura-stealer-reverse-engineering/): Five code obfuscation layers broken, transport encryption reversed, and the full server-pushed config decrypted from a live Aura Stealer C2. Heaven's Gate, CFF, FNV-1a hash tables, and AES-256-CBC.
- [Pay2Key encryptor: what a January 2026 build reveals](https://www.derp.ca/research/pay2key-ransomware-crypto-briefing/): Crypto analysis of a Jan 2026 Pay2Key encryptor. ChaCha20 + Curve25519 via OpenSSL, null nonce, session.tmp on disk. Intermittent mode leaves 70-87% plaintext in large files.
- [A Sliver dropper that asks GPT-4 for permission](https://www.derp.ca/research/ai-gated-sliver-dropper/): Analysis of a Go binary that sends host telemetry to GPT-4 and only drops its Sliver C2 payload if the model says the environment is safe. We recovered the full system prompt.
- [InterLock: full tooling teardown of a ransomware operation](https://www.derp.ca/research/interlock-tooling-teardown/): Static analysis of 15 InterLock samples: ScreenConnect delivery, NodeSnake implants in three languages, a shared crypter, and dual-platform ransomware.
- [Payload ransomware group: mutex MakeAmericaGreatAgain](https://www.derp.ca/research/payload-ransomware-babuk-derivative/): Full static analysis of the Payload ransomware group: Curve25519 and ChaCha20 encryption, Windows and ESXi builds, Babuk-derived kill lists, and a leak site that has since run to 65 organisations.
- [HellsUchecker: ClickFix to blockchain-backed backdoor](https://www.derp.ca/research/hellsuchecker-clickfix-etherhiding/): A 10-stage ClickFix chain uses finger.exe, EtherHiding smart contracts, and Hell's Gate syscalls to deliver a memory-resident x64 backdoor.
- [Tranium wiper: static analysis of a Go binary](https://www.derp.ca/research/tranium-wiper-analysis/): Analysis of Tranium, a Go wiper disguised as ransomware. AES-CBC encryption, MBR overwrite, 30+ system files destroyed, 10 persistence mechanisms, zero payment infrastructure.
- [GhostWeaver - a malware that lives up to its name](https://www.derp.ca/research/ghostweaver-tag124-powershell-rat/): A TAG-124 fileless PowerShell RAT with 1/76 VT detection. We decoded the wire protocol, four DGA systems, persistence modes, and probed the live C2 server.
- [FakeGit: LuaJIT malware distributed via GitHub at scale](https://www.derp.ca/research/fakegit-luajit-github-campaign/): A Vietnamese operator has run 600+ malicious ZIPs through 47+ GitHub accounts for 13 months. C2 resolves via Polygon smart contract. Final payload is StealC.
- [OCRFix botnet hides C2 in BNB Smart Chain contracts](https://www.derp.ca/research/ocrfix-etherhiding-botnet/): A three-stage VBSEdit botnet uses BSC testnet smart contracts to resolve C2 URLs at runtime. One blockchain transaction rotates every bot to a new domain.
- [Archive.org Stego Delivers Remcos and AsyncRAT](https://www.derp.ca/research/archive-org-stego-campaign/): An operator hides .NET injector DLLs in 4K wallpaper JPEGs on archive.org, rotating daily across four accounts to deliver Remcos and AsyncRAT.
- [IronChain: A Ransomware That Cannot Decrypt](https://www.derp.ca/research/ironchain-wiper-analysis/): Static analysis of IronChain, a Python wiper disguised as ransomware. The RSA-4096 private key is never saved or exfiltrated -- encrypted files are permanently lost.
- [Python Loader Evolution: Five Encryption Generations](https://www.derp.ca/research/python-loader-evolution/): Five generations of Python loader encryption in a 9-RAT campaign: from plaintext RC4 to polymorphic Unicode bytecode, with Donut Chaskey CTR shellcode bridging to .NET.
- [Remcos Banking Fraud via Three AutoIt Persistence Chains](https://www.derp.ca/research/remcos-autoit-persistence/): Three AutoIt persistence chains deliver Remcos v7.0.1 Pro for Canadian banking fraud. The third delivers PureHVNC on shared PureLogs C2 infrastructure.
- [PureCrypter: Reverse Engineering a .NET Loader From the PureCoder Ecosystem](https://www.derp.ca/research/purecrypter-loader-analysis/): Technical analysis of PureCrypter, a builder-generated .NET crypter from the PureCoder malware-as-a-service ecosystem, recovered from a multi-stage intrusion tracked as SERPENTINE#CLOUD. Two builds fully reversed.
- [VioletWorm v4.7 (Violet RAT): The Most Dangerous Payload in a 9-RAT Toolkit](https://www.derp.ca/research/violet-rat-analysis/): Technical analysis of VioletWorm v4.7 (also tracked as Violet RAT) -- a .NET RAT with ransomware, HVNC, USB spreading, crypto clipping, and 120 command branches dispatched through C2-delivered plugin DLLs -- recovered from a multi-stage intrusion with tooling overlap to SERPENTINE#CLOUD.
- [PureLogs: Reverse Engineering a .NET RAT From the PureCoder Ecosystem](https://www.derp.ca/research/plog-rat-analysis/): Technical analysis of two PureLogs variants from the PureCoder MaaS ecosystem -- a plugin stager and a monolithic crypto-stealing fat client -- recovered from a multi-stage intrusion tracked as SERPENTINE#CLOUD.
- [GitHub Honeypot Scam: sOLarFLaMEPyL/Arbitrage_Mev_BOT](https://www.derp.ca/research/arbitrage-mev-bot-honeypot-scam/): Reverse engineering a fund-draining honeypot smart contract disguised as a MEV arbitrage bot on GitHub, exposing the hidden backdoor and withdrawal mechanism.