https://blog.efespain.com/en/tags/upx/A honeypot in some corner of the network. Every infection, a story worth telling.HugoeneFeSpaineFeSpain2026 eFeSpainSat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-8/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-8/We peel the APK apart layer by layer: a DEX that's nothing but a launcher, an app that nails itself into /system if there's root, and a native DDoS engine. The C2 slammed the door in my face — until I came back another way and it opened.https://blog.efespain.com/en/chapter-6/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-6/We unpack RedTail's miner and crack it open in Ghidra hunting for the pool and the wallet. What we find is more interesting than a number: the data is in there, embedded and encrypted — and nobody has published how to crack it.