https://blog.efespain.com/en/tags/xor/A honeypot in some corner of the network. Every infection, a story worth telling.HugoeneFeSpaineFeSpain2026 eFeSpainTue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-24/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-24/The previous chapter left a number unexplained: the backdoor was deleting a different process on every installation, and that can't be known in advance. I open the miner and the answer shows up — a template with the gap already reserved. Along the way out comes the wallet the money goes to, behind encryption that's frankly laughable.https://blog.efespain.com/en/chapter-2/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-2/In Chapter 1 the C2 stayed encrypted inside the binary. Here I open it with Ghidra and it comes out whole — but on the way, everything else this critter carries turns up too: how it disguises itself as a system process, how it kills the competition using the very trail that gives it away, and how it lies about its own address when its command centre tells it to.https://blog.efespain.com/en/chapter-4/Sat, 01 Aug 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-4/The bot from the last chapter kept its config encrypted and its orders under lock and key. Ghidra spills the lot: the decryption (a laughable XOR), the botnet's real name, its C2 protocol and its full arsenal — without handing out weapons.