Disclaimer: This repository is intended strictly for security research, education, and awareness purposes. No malicious code is hosted here. All analysis is performed in isolated environments and documented for defensive purposes only. Any artifacts, files, or other pieces of source code / applications you download from sandboxes are used at your own risk. I do not support conducting your own analysis unless you have the ability to do so. I am not responsible for accidental infections, inproper handling, and anything else you do with the artifacts found during my analysis.
This repository serves as a curated collection of malware analyses conducted for the following purposes:
- Security Awareness — Understanding how malware operates to better defend against it
- YARA Detection Rules — Developing and sharing signatures to detect malware families
- Professional Development — Demonstrating a deep, technical understanding of malware behavior, techniques, and indicators of compromise (IOCs)
Each entry includes a breakdown of the malware's behavior, tactics, techniques, and procedures (TTPs) mapped where applicable to the MITRE ATT&CK framework.
Malware Analysis/
├── README.md
├── OneBrowser/
│ ├── onebrowser-malware-analysis.md # Technical deep-dive
│ ├── onebrowser-malware-write-up.md # Summary / report
│ └── Images/ # Screenshots, diagrams, traffic captures
└── Quartzline/
├── quartzline-malware-analysis.md # Technical analysis
└── Images/ # Screenshots (VirusTotal, WHOIS, certificates, POST bodies)
└── Win11Debloater/
├── win11debloater-malware-analysis.md # Technical analysis
└── Images/ # Analysis images and diagrams
| Malware | Category | Write-Up | Technical Analysis |
|---|---|---|---|
| OneBrowser | PUA / Adware | Write-Up | Analysis |
| Quartzline ("MalMiner") | Suspected loader / beacon (unconfirmed) | N/A | Analysis |
| Win11Debloater ("win-11-debloater") | Trojanized utility / RedLine Stealer | N/A | Analysis |
Analyses are performed using a combination of static and dynamic techniques, including but not limited to:
- Static Analysis: PE inspection, string extraction, disassembly (Ghidra / IDA)
- Dynamic Analysis: Behavioral monitoring in sandboxed VMs (Process Monitor, Wireshark, x64dbg)
- YARA Rules: Custom signatures authored to detect identified samples
- Threat Intelligence: Cross-referencing IOCs against VirusTotal, MalwareBazaar, and open-source feeds
All samples analyzed in this repository were obtained through legitimate means (public malware repositories, sandboxes, or controlled environments). This work is conducted to:
- Contribute to the security community's collective defense knowledge
- Develop and sharpen reverse engineering and threat analysis skills
- Produce actionable detection content (YARA rules, IOCs) for defenders
This repository does not contain live malware samples, exploit code, or any tools designed to cause harm.
For questions, collaboration, or responsible disclosure inquiries, feel free to reach out via GitHub.