Malware Analysis Space

  Regin: Static Analysis of Its Lightweight VFS Abstraction Layer Polymorphic Kernel Interfaces and I/O Abstraction Layer     “To understand the immeasurable, the mind must be extraordinarily quiet, still.” — Jiddu Krishnamurti     Seeker( 李标明 ) · @clibm079     China · Independent Malware Analyst & Researcher  From 2025.9.24 to 2025.10.14 Prologue: The Temple and the Kernel Recently, I still climbed a mountain and visited the temple again, but only a few times; sometimes, I go hiking in the forests. Here, I keep moving on malware research. I notice that quite sophisticated malware Regin, between 2014 and 2015, Symantec and Kaspersky published their report of analysis.   According to a Symantec report, “Regin is a multi-staged, modular threat, meaning that it has a number of components, each depending on others, to perform attack operations.”   In this report, I would like to do and share li...

  Poems of Malware Analysis Shadows in the Stack: Notes from the Binary Jungle     “To understand the immeasurable, the mind must be extraordinarily quiet, still.” — Jiddu Krishnamurti   Seeker( 李标明 ) @clibm079 China ( 中国 ) Independent Malware Analyst & Researcher | Author of The Path of Clarity From 2025.6 to 2025.12     Prologue For me, poetry is a quiet dialogue with myself, a way to give voice to emotions I cannot say aloud.     Over a decade ago, I immersed myself in literature and began learning to write poetry. During journeys to serve customers, I found myself capturing what I saw and felt in verse. Those experiences became some of the most vivid memories of my early life as a programmer.   Years later, I entered a new chapter of my life as a cybersecurity researcher in a lab, where I chose the path of malware analysis. A year and a half later, I left the lab, but still on the path. I c...