Deep Malware Analysis Reports

Dive deep into the latest behavior analysis and reverse engineering reports generated by Joe Sandbox and Joe Reverser.

Sandbox Reports

Cloud 42.3.0

17/10/2025
info-stealer

Rhadamanthys delivered by an in-browser fake Windows Update, abusing the Fullscreen API (on-click), and using ClickFix-style

hxxps://thefatshallot[.]com/

Open Report

Cloud 42.0.0

21/05/2025
rat

CloudFlare Theme ClickFix/CAPTCHAScam dropping Redline

hxxp://gogocharters[.]com/lexington-charter-bus

Open Report

Cloud 42.0.0

13/05/2025
phishing

Phishing Chain from e-Mail to Catpcha to Tycoon2FA

SHA256: c99ce182e582b618ae2fe4c7258fc113625730739086e73029f022fb689588b4

Open Report

Cloud 41.0.0

31/10/2024
phishing

CloudFlare Theme ClickFix/CAPTCHAScam dropping NetSupport RAT

hxxps://webdemo[.]biz

Open Report

Cloud 40.0.0

09/07/2024
phishing

EvilProxy using open redirect vulnerability

https://m.exactag.com/ai.aspx?tc=d9282403bc40b07205bbd26a23a8d2e6b6b4f9&url=http%3Asellartatauction.com/oplo/osiwuhjfmniek/bobibobi@outlook.com

Open Report

Cloud 40.0.0

10/05/2024
rat

HTML payload leading to download and installation of WSHRAT

SHA256: 427fb9938ca75db1a362fe51356a1dc06350daa5f9db788a4ca2f7e2cb21fd34

Open Report

Cloud 40.0.0

07/05/2024
phishing

HTML based phisher exhibiting a large spectrum of malicious behaviors

SHA256: 360a04ca0c6ef3401d14f04089d6e7e08869ab298dbf842d8f063bfaca618891

Open Report

Cloud 38.0.0

12/07/2023
exploiter

CVE-2023-36884 using RTF to load Word DOC via MSHTML iframe injection

SHA256: a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f

Open Report

Cloud 38.0.0

15/06/2023
info-stealer

SolarMarker with file pumping, valid PE signature, Powershell dropper and .Net backdoor

SHA256: 6f7332625d573ccc7b14264ee0db7e671305e1206c7eaf920e17c26f7b5b64a7

Open Report

Cloud 37.0.0

15/02/2023
ransomware

STOP Djvu Ransomware via SmokeLoader with full config extracted

SHA256: 5ea4451ca1ce36db2dc6e7a85f07c748ddbb758b65f2194d734afd08bd141126

Open Report

Cloud 36.0.0

15/09/2022
trojan

AgentTesla v3 with full malware configuration

SHA256: c6dae959f8e5373c6ac8746cfd8227b8d8099b692ee726aacbe18ecf1479282e

Open Report

Cloud 35.0.0

26/07/2022
trojan

Stealthy new payload delivery method: HTML (showing a PW) -> ZIP encrypted -> ISO -> LNK -> Calc.exe -> DLL -> DLL -> QBOT

SHA256: f5c16248418a4f1fd8dff438b26b8da7f587b77db9e180a82493bae140893687

Open Report

Cloud 33.0.0

01/02/2022
exploiter

noPac using CVE-2021-42287 - CVE-2021-42278 Exploit to gain DC Admin

SHA256: 4e37819484e865f8e20c2aaa94ec05f3bfe3bb6f36ea4bb6df376c8d4f1ffcca

Open Report

Cloud 33.0.0

12/01/2022
trojan

SysJoker Multi-Platform Backdoor

SHA256: 1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c

Open Report

Cloud 33.0.0

23/12/2021
trojan

Emotet dropped by Hidden Macro

SHA256: bb1f500a59544aa8e44a0377cc506dfbebca1ecb7a8c73dc72d3268803976ff5

Open Report

Cloud 33.0.0

25/08/2021
info-stealer

Kimsuky Espionage Campaign, JS instrumentation

SHA256: 20eff877aeff0afaa8a5d29fe272bdd61e49779b9e308c4a202ad868a901a5cd

Open Report

Cloud 33.0.0

22/07/2021
info-stealer

Hanictor analysis with VBA and shellcode execution graph, dropping FickerStealer

SHA256: 83c9c9beaca0a147e23995b84792f56cd130ccf262147374bd1114c2ac698fee

Open Report

Cloud 33.0.0

15/07/2021
ransomware

Kaseya attack dropping Sodinokibi

SHA256: 939aae3cc456de8964cb182c75a5f8cc

Open Report