https://artfuldodger10.github.io/Artful DodgerResearch notes on malware analysis, detection engineering, and reverse engineering by Nader Ayman. 2026-10-24T18:30:37+00:00 Nader Ayman Elsehrawii https://artfuldodger10.github.io/ Jekyll © 2026 Nader Ayman Elsehrawii /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png Lumma Campaign C++ Crypter2026-10-11T00:00:00+00:00 2026-10-12T00:52:07+00:00 https://artfuldodger10.github.io/posts/Lumma-crypter-Analysis/ Nader Ayman Elsehrawii Reversing a multi-stage chain: an obfuscated C++ crypter hollows MSBuild.exe to run a dropper, which installs a .NET crypto clipper and a second crypter carrying Lumma Stealer. Lumma Campaign GO Loader2026-10-09T21:00:00+00:00 2026-10-12T01:00:49+00:00 https://artfuldodger10.github.io/posts/Lumma-GO-Analysis/ Nader Ayman Elsehrawii Reversing a Go loader that hides Lumma Stealer inside itself and injects it into explorer.exe. XWorm — From Phishing Email to RAT2026-09-06T00:00:00+00:00 2026-09-28T07:36:35+00:00 https://artfuldodger10.github.io/posts/Xworm-Analysis/ Nader Ayman Elsehrawii Static and dynamic analysis of a multi-stage XWorm V7.1 delivery chain — from a spoofed MOHRE phishing email to a fully operational RAT injected into MSBuild.exe XWorm Downloader — VBScript Analysis2026-07-31T00:00:00+00:00 2026-09-28T07:09:04+00:00 https://artfuldodger10.github.io/posts/XWorm-RAT-Malware-Analysis/ Nader Ayman Elsehrawii Static analysis of an XWorm VBScript downloader — deobfuscation, payload extraction, and infrastructure analysis of a dead-C2 sample. AgentTesla RAT2026-06-16T00:00:00+00:00 2026-07-13T21:22:41+00:00 https://artfuldodger10.github.io/posts/AgentTesla-RAT-Full-Malware-Analysis-Report/ Nader Ayman Elsehrawii Hands-on reverse engineering of a multi-stage AgentTesla malware. Covers the complete loader chain, steganographic payload recovery, process hollowing, SMTP configuration extraction, and analysis of the final AgentTesla payload.