https://brhopkins.uk/A blog written by Ben Hopkins: Malware and Threat Specialist at zeroShadow. Covers malware reverse engineering, threat hunting, and other cybersecurity research. 2026-07-09T11:46:32+00:00 Ben Hopkins https://brhopkins.uk/ Jekyll © 2026 Ben Hopkins /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png 2025-07-13T00:00:00+00:00 2025-07-13T00:00:00+00:00 https://brhopkins.uk/posts/phenedrome-part-2/ Ben Hopkins

Overview In the last blog, I covered a campaign that was being conducted by a cybercriminal using the Phenedrome stealer, which hasn’t been seen in a while. In the last blog, I covered the fake AnyDesk website stood up by the threat actor, and how that was used to socially engineer a victim into downloaded a loader for Phenedrome. If you want to read that blog first, feel free to go to the lin...

2025-06-20T00:00:00+00:00 2025-06-20T00:00:00+00:00 https://brhopkins.uk/posts/phenedrome-part-1/ Ben Hopkins

Overview A few days ago, I was scrolling X (formally Twitter) where I follow other people in the cyber community, and came across a post about a threat actor impersonating the AnyDesk website to socially engineer victims into downloading malware. AnyDesk is a remote mangement and monitoring (RMM) tool that has platform-independant remote access solutions that IT support can use to service user...

2025-02-15T00:00:00+00:00 2025-02-15T00:00:00+00:00 https://brhopkins.uk/posts/async-rat/ Ben Hopkins

Overview AsyncRAT is a remote access trojan (RAT) built to remotely monitor and control other computers through a secure, encrypted connection. The name “AsyncRAT” comes from its core functionality—’async’ means it performs its operations asynchronously, which means it is capable of executing several tasks simultaneously. AsyncRAT has been observed as being bought, sold, and deployed for years...

2024-11-15T00:00:00+00:00 2024-11-15T00:00:00+00:00 https://brhopkins.uk/posts/payload-placement/ Ben Hopkins

In malware development, payload placement refers to where and how the malicious code (the payload) is embedded or hidden within a system to execute harmful functions without detection. Use cases for this technique could involve creating a benign-seeming executable or DLL and having it execute and load it’s resorces into memory, with the resource being the payload. In this blog, I’ll cover payl...

2024-10-30T00:00:00+00:00 2024-10-30T00:00:00+00:00 https://brhopkins.uk/posts/js-deob/ Ben Hopkins

With JavaScript being a popular programming language used in many web technologies, it often gets used by threat actors as initial stage payloads. Such scripts could have Powershell code embedded in them, further malware stagers, or functions for downloading malware from an attacker’s C2 server. Because JavaScript is a high-level language, it’s human-readable and logically easy to understand, s...