https://d01a.github.io/posts/

1<!doctype html><html lang=en><head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><meta name=robots content="noodp"><title>All Posts - d01a</title><meta name=Description content="This is my personal blog. All about Malware Analysis, Reverse engineering, CTI and DE&amp;TH"><meta property="og:url" content="https://d01a.github.io/posts/"><meta property="og:site_name" content="d01a"><meta property="og:title" content="Posts"><meta property="og:description" content="This is my personal blog. All about Malware Analysis, Reverse engineering, CTI and DE&amp;TH"><meta property="og:locale" content="en"><meta property="og:type" content="website"><meta property="og:image" content="https://d01a.github.io/assets/image/avatar.png"><meta name=twitter:card content="summary_large_image"><meta name=twitter:image content="https://d01a.github.io/assets/image/avatar.png"><meta name=twitter:title content="Posts"><meta name=twitter:description content="This is my personal blog. All about Malware Analysis, Reverse engineering, CTI and DE&amp;TH"><meta name=application-name content="d01a"><meta name=apple-mobile-web-app-title content="d01a"><meta name=referrer content="no-referrer"><meta name=theme-color content="#ffffff"><meta name=msapplication-TileColor content="#da532c"><link rel=icon href=./images/Luffy.svg><link rel=apple-touch-icon sizes=180x180 href=/apple-touch-icon.png><link rel=mask-icon href=/safari-pinned-tab.svg color=#5bbad5><link rel=manifest href=/site.webmanifest><link rel=canonical href=https://d01a.github.io/posts/><link rel=alternate href=/posts/index.xml type=application/rss+xml title=d01a><link rel=feed href=/posts/index.xml type=application/rss+xml title=d01a><link rel=stylesheet href=/css/style.min.css><link rel=preload href=https://cdn.jsdelivr.net/npm/@fortawesome/[email protected]/css/all.min.css as=style onload='this.onload=null,this.rel="stylesheet"'><noscript><link rel=stylesheet href=https://cdn.jsdelivr.net/npm/@fortawesome/[email protected]/css/all.min.css></noscript><link rel=preload href=https://cdn.jsdelivr.net/npm/[email protected]/animate.min.css as=style onload='this.onload=null,this.rel="stylesheet"'><noscript><link rel=stylesheet href=https://cdn.jsdelivr.net/npm/[email protected]/animate.min.css></noscript></head><body data-header-desktop=fixed data-header-mobile=auto>

1<script>const query=window.matchMedia("(prefers-color-scheme: dark)");function applyTheme(){let e=window.localStorage?.getItem("theme")||"auto",t=e==="dark"||e==="auto"&&query.matches;document.body.setAttribute("theme",t?"dark":"light"),document.body.setAttribute("cfg-theme",e)}applyTheme(),query.addEventListener("change",applyTheme)</script>

1<div id=mask></div><div class=wrapper><header class=desktop id=header-desktop><div class=header-wrapper><div class=header-title><a href=/ title=d01a><span class=header-title-pre><i class='fa-solid fa-terminal' aria-hidden=true></i></span>d01a</a></div><div class=menu><div class=menu-inner><a class="menu-item active" href=/posts/ title=Posts>Posts </a><a class=menu-item href=/tags/ title=Tags>Tags </a><a class=menu-item href=/categories/ title=Categories>Categories </a><a class=menu-item href=/about/>About </a><a class=menu-item href=https://github.com/d01a title=GitHub rel="noopener noreffer" target=_blank><i class='fab fa-github fa-fw' aria-hidden=true></i> </a><span class="menu-item delimiter"></span><span class="menu-item search" id=search-desktop>
2<input type=text placeholder="Search titles or contents..." id=search-input-desktop>
3<a href=javascript:void(0); class="search-button search-toggle" id=search-toggle-desktop title=Search><i class="fas fa-search" aria-hidden=true></i>
4</a><a href=javascript:void(0); class="search-button search-clear" id=search-clear-desktop title=Clear><i class="fas fa-times-circle" aria-hidden=true></i>
5</a><span class="search-button search-loading" id=search-loading-desktop><i class="fas fa-spinner fa-spin" aria-hidden=true></i>
6</span></span><a href=javascript:void(0); class="menu-item theme-switch" title="Switch Theme"><i class="fas fa-adjust" aria-hidden=true></i></a></div></div></div></header><header class=mobile id=header-mobile><div class=header-container><div class=header-wrapper><div class=header-title><a href=/ title=d01a><span class=header-title-pre><i class='fa-solid fa-terminal' aria-hidden=true></i></span>d01a</a></div><div class=menu-toggle id=menu-toggle-mobile><span></span><span></span><span></span></div></div><div class=menu id=menu-mobile><div class=search-wrapper><div class="search mobile" id=search-mobile><input type=text placeholder="Search titles or contents..." id=search-input-mobile>
7<a href=javascript:void(0); class="search-button search-toggle" id=search-toggle-mobile title=Search><i class="fas fa-search" aria-hidden=true></i>
8</a><a href=javascript:void(0); class="search-button search-clear" id=search-clear-mobile title=Clear><i class="fas fa-times-circle" aria-hidden=true></i>
9</a><span class="search-button search-loading" id=search-loading-mobile><i class="fas fa-spinner fa-spin" aria-hidden=true></i></span></div><a href=javascript:void(0); class=search-cancel id=search-cancel-mobile>Cancel</a></div><a class=menu-item href=/posts/ title=Posts>Posts</a><a class=menu-item href=/tags/ title=Tags>Tags</a><a class=menu-item href=/categories/ title=Categories>Categories</a><a class=menu-item href=/about/ title>About</a><a class=menu-item href=https://github.com/d01a title=GitHub rel="noopener noreffer" target=_blank><i class='fab fa-github fa-fw' aria-hidden=true></i></a><a href=javascript:void(0); class="menu-item theme-switch" title="Switch Theme">
10<i class="fas fa-adjust" aria-hidden=true></i></a></div></div></header><div class="search-dropdown desktop"><div id=search-dropdown-desktop></div></div><div class="search-dropdown mobile"><div id=search-dropdown-mobile></div></div><main class=main><div class=container><div class="page archive"><h2 class="single-title animate__animated animate__pulse animate__faster">All Posts</h2><h3 class=group-title>2026</h3><article class=archive-item><a href=/xloader/ class=archive-item-link>The road to Xloader</a>
11<span class=archive-item-date>09-05</span></article><h3 class=group-title>2024</h3><article class=archive-item><a href=/redline/ class=archive-item-link>Redline stealer</a>
12<span class=archive-item-date>05-30</span></article><article class=archive-item><a href=/alphv/ class=archive-item-link>ALPHV ransomware</a>
13<span class=archive-item-date>05-30</span></article><h3 class=group-title>2023</h3><article class=archive-item><a href=/syscalls/ class=archive-item-link>Understanding Syscalls: Direct, Indirect, and Cobalt Strike Implementation</a>
14<span class=archive-item-date>08-18</span></article><article class=archive-item><a href=/pikabot/ class=archive-item-link>Pikabot deep analysis</a>
15<span class=archive-item-date>07-31</span></article><article class=archive-item><a href=/aurora-stealer-builder/ class=archive-item-link>

15Aurora Stealer Builder</a>
16<span class=archive-item-date>04-23</span></article><article class=archive-item><a href=/aurora-stealer/ class=archive-item-link>Aurora Stealer</a>
17<span class=archive-item-date>04-12</span></article><article class=archive-item><a href=/originlogger/ class=archive-item-link>OriginLogger Loader</a>
18<span class=archive-item-date>01-16</span></article><h3 class=group-title>2022</h3><article class=archive-item><a href=/raccoon-stealer/ class=archive-item-link>Raccoon Stealer</a>
19<span class=archive-item-date>09-12</span></article></div></div></main><footer class=footer><div class=footer-container><div class=footer-line>Powered by <a href=https://gohugo.io/ target=_blank rel="noopener noreffer" title="Hugo 0.165.0">Hugo</a> | Theme - <a href=https://github.com/dillonzq/LoveIt target=_blank rel="noopener noreffer" title="LoveIt 1.0.0"><i class="far fa-kiss-wink-heart" aria-hidden=true></i> LoveIt</a></div><div class=footer-line itemscope itemtype=http://schema.org/CreativeWork><i class="far fa-copyright" aria-hidden=true></i><span itemprop=copyrightYear>2022 - 2026</span><span class=author itemprop=copyrightHolder>&nbsp;<a href=https://www.linkedin.com/in/mohamedadel46/ target=_blank>Mohamed Adel</a></span>&nbsp;|&nbsp;<span class=license><a rel="license external nofollow noopener noreffer" href=https://creativecommons.org/licenses/by-nc/4.0/ target=_blank>CC BY-NC 4.0</a></span></div></div></footer></div><div id=fixed-buttons><a href=# id=back-to-top class=fixed-button title="Back to Top"><i class="fas fa-arrow-up" aria-hidden=true></i></a></div><div id=fixed-buttons-hidden><a href=# id=view-comments class=fixed-button title="View Comments"><i class="fas fa-comment" aria-hidden=true></i></a></div><link rel=stylesheet href=https://cdn.jsdelivr.net/npm/[email protected]/dist/katex.min.css>

19<script src=https://cdn.jsdelivr.net/npm/[email protected]/dist/autocomplete.min.js></script>

19<script src=https://cdn.jsdelivr.net/npm/[email protected]/lunr.min.js></script>

19<script src=https://cdn.jsdelivr.net/npm/[email protected]/lazysizes.min.js></script>

19<script src=https://cdn.jsdelivr.net/npm/[email protected]/dist/clipboard.min.js></script>

19<script src=https://cdn.jsdelivr.net/npm/[email protected]/sharer.min.js></script>

19<script src=https://cdn.jsdelivr.net/npm/[email protected]/dist/katex.min.js></script>

19<script src=https://cdn.jsdelivr.net/npm/[email protected]/dist/contrib/auto-render.min.js></script>

19<script src=https://cdn.jsdelivr.net/npm/[email protected]/dist/contrib/copy-tex.min.js></script>

19<script src=https://cdn.jsdelivr.net/npm/[email protected]/dist/contrib/mhchem.min.js></script>

19<script>window.config={math:{delimiters:[{display:!0,left:"$$",right:"$$"},{display:!0,left:"\\[",right:"\\]"},{display:!0,left:"\\begin{equation}",right:"\\end{equation}"},{display:!0,left:"\\begin{equation*}",right:"\\end{equation*}"},{display:!0,left:"\\begin{align}",right:"\\end{align}"},{display:!0,left:"\\begin{align*}",right:"\\end{align*}"},{display:!0,left:"\\begin{alignat}",right:"\\end{alignat}"},{display:!0,left:"\\begin{alignat*}",right:"\\end{alignat*}"},{display:!0,left:"\\begin{gather}",right:"\\end{gather}"},{display:!0,left:"\\begin{CD}",right:"\\end{CD}"},{display:!1,left:"$",right:"$"},{display:!1,left:"\\(",right:"\\)"}],strict:!1},search:{highlightTag:"em",lunrIndexURL:"/index.json",maxResultLength:10,noResultsFound:"No results found",snippetLength:30,type:"lunr"}}</script>

19<script src=/js/theme.js></script>

19</body></html>