MalHawk

MalHawk

Blogs

Fileless PowerShell Dropper

July 15, 2026 trojanpowershellJSbase64RegAsmAV-evasionmulti-payloaddropperpaste-binsdynamic-dns

Analysis of a multi-stage fileless dropper using JScript, PowerShell, and process hollowing to deliver a reversed Base64 PE payload via Dynamic DNS.

The .NET Library That Isn't: Inside OysterLoader's Stage 2 Payload

May 5, 2026 OysterLoader-stage2AspNetCore.CorsRWXtrusted infrastructure abusetrojanrpp_dl_19_3.dllanti-analysisDllsystem binaryProxy execution

Analysis of a stage 2 OysterLoader payload.

How a Fake WinSCP Installer Loads Malware

March 15, 2026 OysterLoaderCleanUploadertrusted-infrastructure-abusetrojanWinSCPPuTTYBroomstickoverlayanti-analysis

Analysis of a trojanized WinSCP installer functioning as the OysterLoader and attempting to retrieve a second-stage payload

Fake Browser Update that Loads Malware

November 30, 2025 SocGholishloaderfake-browser-updatesdrive-by-downloadbase64C2JavascriptruntimeActiveXObjectMSXML2.XMLHTTPOpenPGP-encryption

Analysing Socgholish, a Javascript malware Loader.

Inside Redline, a Common Password-Stealing Malware

September 26, 2025 redlineinfo-stealercrypto walletstrojanbase64xorprocess hollowingexfiltrationC2pua

Analysing a commodity infostealer focused on harvesting credentials and wallet data.