Zero-Day Reverse Engineering Sandbox

Analyze raw zero-day malware binaries, reflective DLL injections, and Linux ELF exploits. Inspect AI-guided assembly disassembly, C pseudocode decompilation, runtime syscall traces, and generate automated YARA IOC rules.

AegisRansom_v4.dll (Reflective Injection)

CRITICAL

x86_64

SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Type: Ransomware / Process Hollowing

Disassembled Assembly (x86_64)

Low-level instruction flow, register modifications, and control-flow branches.

; Subroutine: Anti-Debugging Check & Process Injection
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, gs:[0x60]          ; Read PEB (Process Environment Block)
movzx eax, byte ptr [rax+2] ; BeingDebugged flag check
test eax, eax
jnz .debugger_detected
call VirtualAllocEx          ; Allocate RWX memory in target process
mov rbx, rax
call WriteProcessMemory       ; Inject payload bytes
call CreateRemoteThread       ; Execute hijacked execution flow

Analyze Custom Binary or Shellcode

Paste raw assembly code, hex bytes, or C code snippet to disassemble and generate YARA rules.