-
Analysis of NWHStealer Bun loader
In the last weeks a new malware sample has emerged and caught the attention, being one of the most download sample from Malwarebazaar. This malware is the new NWHStealer and different types of loader are emerging to try to spread it as much as possible. This particular loader analyzed here has been built using Bun, a relatively new JavaScript runtime engine written in Zig but that, at the moment, it’s being rewritten in Rust. This engine has been acquired by Anthropic recently, so it has some attention behind. In this blog post i will analyze this loader, showing how the executable is structured and what it does once executed.
-
Crackmes.one nukoneZ's Ransomware
On the famous crackmes.one site, a challenge named
nukoneZ's Ransomwarewas awarded as the best challenge for the month of June 2025. This challenge was the last to be awarded, since it seems the website didn’t announce other winners in the following months. Moved by curiosity, I’ve played this challenge and here’s the writeup. -
Gh0stCringe RAT analysis
As exercise, I’ve decided to find a malware sample on MalwareBazaar to analyze. I was looking for a Windows malware written in C/C++, so I chose the sample described in this post. This is not a new threat on the web and after the analysis, with more knowledge about its functionalities, I can say that, probably, it’s a variant of a Ghost RAT malware, known as Gh0stCringe.