MalwareAnalysisSeries

Welcome to the MalwareAnalysisSeries repository, your go-to destination for highly refined analysis reports, useful reverse engineering tools & scripts, unpacked malware stages, extracted TTPs and its development. This open-source pet project is dedicated to dissecting infamous malware families, offering deep technical insights assisting in advance analysis and reverse engineering. The process of malware development is also covered in this repository as each significant TTP is recreated in exact way as the actual malware.

Purpose

The primary goal of MalwareAnalysisSeries is to provide a comprehensive resource for cybersecurity enthusiasts, researchers, and professionals alike. By delving into the intricate workings of prominent malware families, my aim is to empower the community with invaluable knowledge and tools to enhance their understanding of cybersecurity threats and bolster defense mechanisms.

Whoami

Shayan Ahmed Khan @shaddy43 Threat Researcher | Detection & Response | MalDev GREM, SC-200, AZ-500, PMRP, HCIA Security I believe in open-source work & contributions!

Malware Analysis Repositories

Title	Description
AI-Assisted-Reversing	Evaluating an AI agent driving Ghidra over MCP against BrowserSnatch, Ryuk and Xloader 4.3
CrackedHaven	Understand Software Cracking and its Implications
MedusaLocker	Technical Analysis & TTPs of MedusaLocker Ransomware
NanoCore1.2.2.0	Technical Analysis & TTPs of NanoCore RAT 1.2.2.0
Ryuk	Technical Analysis & TTPs of Ryuk Ransomware
Xloader4.3	Technical Analysis & TTPs of Xloader AKA Formbook 4.3 Infostealer
Emotet	Technical Analysis of Emotet Malware

Repository Structure Overview

Directory	Description
[://Malware/]	Contains all malware-related content. Reports/Articles etc
[://Malware/sample/]	Repository of malware samples and their unpacked stages.
[://Malware/tools_and_scripts/]	Collection of tools and scripts used in malware analysis.
[://Malware/Extracted_TTPs/]	Directory containing the Tactics, Techniques, and Procedures (TTPs) identified in the malware and its code recreated after analysis
[://Malware/Extracted_TTPs/TTP(1...n)/Detection]	Specific detection rules associated with each TTP extracted from the malware.
[://Assets/]	Stores visual aids, including images, videos, and GIFs, used in reports and documentation.

Visualized Structure

MalwareAnalysisSeries/
├── Malware/
│   ├── sample/
│   ├── tools_and_scripts/
│   ├── Extracted_TTPs/
│   │   ├── TTP1/
│   │   │   ├── Code/
│   │   │   └── Detection/
│   │   ├── TTP2/
│   │   │   ├── Code/
│   │   │   └── Detection/
│   │   └── ...
│   └── Assets/
├── ...
├── Assets/
└── README.md

MITRE ATT&CK Coverage

Every recreated TTP is mapped to the MITRE ATT&CK framework. The matrix below covers the techniques that currently ship recreated code, and whether a detection artifact accompanies them. For the full picture — every technique observed across all families, grouped by tactic — see the ATT&CK coverage matrix.

Technique	ID	Tactic	Family	Code	Detection
Scheduled Task/Job: Scheduled Task	T1053.005	Persistence / Priv. Esc.	MedusaLocker, NanoCore	✅	✅
Impair Defenses: Disable or Modify Tools	T1562.001	Defense Evasion	MedusaLocker, NanoCore	✅	✅
Data Encrypted for Impact	T1486	Impact	MedusaLocker, Ryuk	✅	⚠️
Service Stop	T1489	Impact	MedusaLocker	✅	✅
Inhibit System Recovery	T1490	Impact	MedusaLocker	✅	✅
Network Share Discovery	T1135	Discovery	MedusaLocker	✅	✅
Input Capture: Keylogging	T1056.001	Credential Access	NanoCore	✅	✅
Boot/Logon Autostart: Registry Run Keys	T1547.001	Persistence	NanoCore	✅	✅
Clipboard Data	T1115	Collection	NanoCore	✅	✅
Data from Local System	T1005	Collection	NanoCore	✅	✅
Subvert Trust Controls: Mark-of-the-Web Bypass	T1553.005	Defense Evasion	NanoCore	✅	✅
Process Injection: Process Hollowing	T1055.012	Defense Evasion	NanoCore	✅	✅
Obfuscated Files: Software Packing	T1027.002	Defense Evasion	NanoCore, Xloader	✅	⚠️
Obfuscated Files: Encrypted/Encoded File	T1027.013	Defense Evasion	Xloader	✅	❌
Non-Application Layer Protocol	T1095	Command & Control	NanoCore	↗	✅
Abuse Elevation Control: Bypass UAC	T1548.002	Priv. Esc. / Defense Evasion	MedusaLocker	↗	✅

Legend: ✅ available  •  ⚠️ partial  •  ↗ external reference, credited on the family page  •  ❌ not yet available (contributions welcome — see CONTRIBUTING.md).

Tooling

The analyses in this repository were produced with the following tools, listed here as a reference for anyone reproducing the work:

• Disassemblers / decompilers: IDA Pro, Ghidra, dnSpy / dnSpyEx (.NET)
• Debuggers: x64dbg / x32dbg, WinDbg, Visual Studio Debugger (VBS/managed)
• Dynamic analysis: REMnux, FLARE-VM, Process Hacker, Process Monitor, Wireshark, INetSim
• Unpacking / triage: PE-bear, CFF Explorer, Detect It Easy (DIE), YARA
• Custom helpers: see each module's tools_and_scripts/ directory

Safe Handling

This repository contains live malware samples and functional offensive code. Handle it responsibly:

• All samples are stored in password-protected archives — the password is infected.
• Only detonate or unpack samples inside an isolated, network-controlled virtual machine with no access to production data or credentials.
• Never run any binary from this repository on a host you cannot afford to lose or re-image.
• See SECURITY.md for the full handling policy and how to report an issue.

Disclaimer

It's important to emphasize that MalwareAnalysisSeries is intended strictly for educational and research purposes. I do not condone or support any form of malicious activity. The tools, scripts, and analysis reports provided here are meant to foster learning, enhance cybersecurity knowledge, and contribute to the collective defense against cyber threats. Any misuse or illegitimate use of the content within this repository is strongly discouraged and goes against the principles of ethical cybersecurity practices.

Join me in this mission to dissect, understand, and combat malware. Together, we can make cyberspace a safer environment for all.