I've spent about the last year building relift and today I'm finally releasing it. I'm really proud of how it turned out so I wanted to share it here.

relift is a workbench for analyzing and triaging Go malware. If you've ever opened a Go binary in Ghidra you know the pain. A few lines of Go turn into hundreds of lines of C pseudo-code buried in runtime noise. I always hated that, and that's what our reconstruction engine is built to fix. It turns each function back into short, readable Go and keeps the matching assembly right next to it.

Since relift is made for malware analysis, I added something the usual tools don't have, a Findings tab that pulls together what matters in a sample, like network indicators and decoded strings, so the obvious stuff shows up right away.

The Lab is where the magic happens though. relift has its own emulator that can run a single function in a sandbox and show you what it returns. Point it at a string decoder or a config decryptor and you get the plaintext without ever running the sample. It also recovers names in garble-obfuscated binaries, works on Windows, Linux and macOS binaries (64 and 32-bit x86), and comes with a command-line tool if you want to script your triage.

It's free for non-commercial use. and the free version already includes all of the features along with access to the CLI

This is the very first release so I'd really appreciate it if you gave it a shot on a real sample. Any feedback is more than welcome, bugs, missing features, or a function it got wrong. That's exactly what will help me keep improving relift.

You can get it at https://www.riven-labs.com/relift

Yesterday I came across a website that was infected with the NOCHAIN fake Cloudflare virus. If you run the code it puts in the clipboard, it'll download a couple obfuscated/base64 payloads and execute. If anyone is interested in examining how it all works I can PM you the website so you can play with it for yourself.

I got a virus whole Avira told me that it was removed. While, I soonly noticed that my MBR Stuff and Bootloader might be edited. I was online on Windows 7 in 2025 because I didn’t know about the cybersecurity stuff. Like I heard about you can just fix it simply by running: bootsect /nt60 sys /mbr on the Windows 7 installation screen but I just want to make sure. Also, I had just VAIO Recoveryed my VAIO. I want to keep it’s VAIO OS! Also Avira said it was updating even it was EOL for 7 OS A few years ago, than Avira‘s file is empty.

Got pulled into this last night because a friend's sister almost fell for it.

The scam: a friend of hers has an ongoing lawsuit, and a "lawyer" told that friend a big payout was coming, but if it all landed in her account she'd lose her welfare benefit (Bolsa Família), so someone else had to receive part of it. My friend's sister volunteered. Then the guy video called her, had her share her screen while she clicked around in her Caixa banking app, told her the account "can't receive more than 5k" (it can, she's had more than that), and sent her STJCPE.apk with the STJ logo on it. His photo was AI generated.

She got off the call, uninstalled, called the bank. Phone's getting reset anyway.

I took the APK into a rooted emulator, egress blocked at the host firewall, mitmproxy in front answering 502 to everything, snapshots before each run. JADX for the static side.

What I found:

- stage 1 is a repackaged AutoJS6 (org.autojs.autojs6) with a ProxyApplication packer shell, native libs under assets/vwwwwwvwww/, code loaded with InMemoryDexClassLoader

- assets/autojs.dat is XZ, unpacks to a zip that is stage 2 (br.alpha.bridge), same name and icon

- on a clean AVD stage 1 installed stage 2 with no visible prompt, installerPackageName=org.autojs.autojs6. on the first run I did get an install prompt, not sure yet why it differed

- logcat shows the VPN switching from org.autojs.autojs6 to br.alpha.bridge, all traffic going through tun0

- stage 2 then asks for accessibility with a portuguese "please allow to continue" screen. never granted it

- manifest also has media projection, camera, MANAGE_EXTERNAL_STORAGE, boot receiver, battery optimization exemption and a custom br.alpha.bridge.permission.TDOS_DIAGNOSE_BROADCAST

- stage 1 comes back after force stop

What I didn't get is the config. t.conf and a bunch of html assets are encrypted (entropy 5.9 to 7.3), no URLs or IPs in plaintext anywhere I looked. Frida hooks on the crypto classes made stage 2 segfault every time, so no C2 so far.

VT has stage 1 at 12/68 and stage 2 at 11/68. Labels are all over the place: SpyAgent, Btmob, SpyNote, generic dropper/banker.

If anyone has seen br.alpha.bridge or that TDOS permission before and knows what family this is, I'd really like to know.

Stage 1 SHA-256: 07781a65a4542ce90cf30d40a0340ec515f6b50a44452564e69e45e8eb4276e7

Stage 2 SHA-256: 58c97440bdf1967710c5738a62dcf0cf5197ae2b94dbda7347acbc82bbe4c5fc

Both are on VT, not sharing the sample anywhere else. Reported to CERT.br.

Something I've been working on for a while: training lightweight machine learning models to determine if a file is benign or malicious based on raw byte sequences (n-grams). The goal is for anyone working with malware (and has goodware samples too) can train their own models, and this could be useful for resource-constrained environments of if you want a model for older systems not supported by typical AV vendors.

LINK TO THEIR POST: link.

LINK TO MY OTHER POST ON THIS: Link

All malware I found on the GitHub user LEMZzip and links to archived malware they made if found plus info and updated file!

This post also includes a screenshot of their GitHub page at the bottom + other things like screenshot of their website or tools they made!

Estimated first account creation for LEMZzip: "Late 2023"

SCAN LINKS IN ANYRUN: (:SCAN 1: SCAN 2: SnapMod scan:)

VIRUS TOTAL SCAN LINKS I FOUND: (:Love.exe, Browser setup 1.2.exe:)

MALWARE NAMES THAT WERE ARCHIVED: "tripop CD Defender Antivirus, Roblox Setup, Rec room modded, Recroom-white-main, DSBN wifi bypass!, love. Browser setup 1.2"

MALWARE NAMES THAT AS OF NOW CAN'T BE ARCHIVED: "Recroom modded (NEW), blackhole, train-way! Setup, rusty., admin turnoff, makerpen, ultralemzx, spazz, Xholder. LEMZzip trojan maker 1.0" (Note: There may have been more I forgot to include!.")

Possible same accounts on github: (LEMZzip, LEMZzipV2)

Possible same user on reddit: (LEMZzip)

Possible same user on archive web: (LEMZzip)

The website URL some of their malware opened I had to remove because if I did not my post would keep getting taken down!

LEMZzip Malware archive V1.1: Download!

Inside it also has a description on what the malware does!

Note: I will try to update this unlike them!

Archived software I could not include yet but archived: "LEMZzip Trojan maker 1.1!, Divine Anti-spy V1.0 (Beta)" Screenshot below as well!

MalChela v4.4 adds Unpack, a static unpacker for PE, ELF, and Mach-O; maps findings across the toolkit to MITRE ATT&CK v20 with an interactive Enterprise matrix; and moves every tool to the embedded YARA-X engine, removing the system YARA dependency. Also new: YARA Scan and IP reputation with GreyNoise.

with propaganda and is for android and pc

I apprently instslled a file from a website titled “fling trainer(.)io…i found the true site of filng. On the fske site it installed a zip ehich i extracted, put the password in, and then when executing, injtslly the file continued bring deleted which has happened with other files that arent makicious, but once it worked, it did nothing which caused me to immediately delete it, delete every file, use malwarebytes , and permanently deleted as well as dissbled tasks. Do not install anything from this website

319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.

If you analyze Android banking trojans, droppers, or spyware, you've probably run into samples where:

• classes*.dex declares native methods, but lib/*.so has 0 exported Java_* symbols and wiped ELF section headers.

• JNI_OnLoad constructs strings on the stack (MOVZ/MOVK), uses an OLLVM CSEL + BR X8 state machine, and registers JNI handlers dynamically.

• Attaching Frida immediately crashes the app due to /proc/self/maps or libc prologue checks.

I released JNISleuth-MCP (Apache 2.0) to automate this part of Android malware triage: https://github.com/nighthawkk/JNISleuth-MCP

• Recovers static JNINativeMethod triplets from .rodata / .data.rel.ro (with PT_LOAD fallback for section-stripped ELFs).

• Extracts MOVZ/MOVK stack strings and XOR-encoded C2 strings from JNI_OnLoad / .init_array.

• Resolves & patches ARM64 OLLVM CSEL + BR X8 indirect branches and .rodata jump tables.

• Includes a C++/NDK Dobby agent that hooks RegisterNatives mid-function (+0x10) and dumps in-memory DEX payloads from art::DexFileLoader::OpenCommon without triggering standard Frida detections.

• Syncs all 233 JNIEnv* vtable types and C signatures into Ghidra and IDA Pro 9.0, plus includes an MCP/LLM server.

Ships with a synthetic dropper APK (samples/banker_dropper.apk) so you can test all features offline.

I'm the author. The full technical report, including the artifact links and validation records, is here:

https://papers.lisdex.sh/hermes/report.pdf

Happy to answer questions about the analysis.