Welcome to BlueTeamCoolTeam
So this is a thing now. BlueTeamCoolTeam is a personal blog where I’ll be publishing hands-on write-ups of real malware samples and incidents — the kind that show up on a Monday morning when someb...
BlueTeamCoolTeam
Telegram Handles, Binary-Encoded PHP, and a Relay Shell: Inside a WordPress Webshell Compromise
A compromised WordPress site, eleven hundred lines of IIS logs, a two-stage binary-encoded webshell, and six attempts to deploy a gsocket reverse shell.
They built a dictionary to hide their shellcode: the pishbini90ai ClickFix loader
A ClickFix loader that hides shellcode as 256 English words in .rdata, delivers via WebDAV-over-HTTPS, and executes via Windows fibers. IOCs and YARA inside.
Fake captcha, five layers of RC4, and a Rust stealer with LSA session enumeration and AD recon
Five-layer RC4+gzip ClickFix stager drops a Rust infostealer with browser extension force-install, LSA session enumeration, and AD recon via NetAPI.
The Node.js loader that locks its own strings to the folder it lives in
A Node.js loader disguised as a dev tool: signed node.exe, extensionless script, folder-keyed string cipher, and an in-memory payload that never touches disk.
A Fake "SystemHealth" Service, a Pyarmor Wall, and Three Ways to Get Paid
A fake SysMon.py in C:\Windows\SystemHealth runs a Pyarmor-locked Python bundle: an XMRig Monero miner, a credential and wallet stealer, and a fake-wallet phisher.
The "SharePoint Helper" That Was Really a Localhost Backdoor
A brand-new scheduled task on a two-year-old host launches a fileless PowerShell HTTP-RAT that listens on localhost only and waits for an operator's tunnel.
The beacon that won't decrypt unless it beats AMSI: pulling apart a WMI-launched PowerShell loader
A WMI-launched PowerShell loader with reflection AMSI/ETW bypass and a payload that only decrypts if its own AMSI bypass succeeded first.
Bring Your Own Node: a PowerShell stager, a blockchain dead-drop, and a RAT that runs on the real Node.js
A PowerShell stager drops the legitimate Node.js runtime, runs a JavaScript RAT under it, and resolves its C2 domain from a TON blockchain smart contract.
A signed OneDrive, a fake note-taking app, and a payload hiding in a PNG: one ClickFix chain, five stages deep
A ClickFix lure drops a 145 MB Electron flomo app. The RAT runs a signed OneDriveLauncher that sideloads a trojanized DLL to decrypt a PNG-wrapped payload.