Loading story…
ESET published Stadeo, a free Python-based malware analysis toolset designed to help reverse engineers deobfuscate malicious code, with an initial focus on the Stantinko botnet. The framework targets two common protections used by malware authors—control-flow flattening and string obfuscation—and was presented at Black Hat USA 2020. Stadeo integrates with IDA and the Miasm reverse-engineering framework through an RPyC server to automate recovery of clearer program logic for analysts.
The release includes workflows for deobfuscating individual functions, processing reachable or all functions in a sample, patching cross-references to recovered code, and revealing hidden strings. While built around Stantinko’s techniques, ESET said the approach was also extended to support Emotet control-flow flattening, broadening the tool’s usefulness for defenders and malware researchers investigating heavily obfuscated threats.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
ESET demonstrated Stadeo for the first time at Black Hat USA 2020 as a toolset to help analysts deobfuscate malware, particularly techniques used by the Stantinko botnet.
ESET subsequently published the Python-based Stadeo toolset for free use on GitHub, providing deobfuscation support for Stantinko and extending the approach to Emotet control-flow flattening.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and government analysts documented how **Emotet** hides its functionality through API hashing, dynamic API resolution, string encryption, junk code, stack tricks, and control-flow flattening, complicating reverse engineering of unpacked samples with empty import tables. Sophos reported that, across 254 examined functions, 68 used flattened control flow; researchers fully unflattened 38, partially restored 19, and failed on 11 while adapting IDA-based tooling to handle multiple dispatchers and other edge cases. Technical work from JPCERT/CC and open-source tooling showed that analysts can automate large parts of Emotet analysis with **Ghidra** and Binary Ninja plugins, including annotating hashed APIs, decrypting strings, and extracting hardcoded command-and-control endpoints from internal configuration data. ANSSI described Emotet as a **malware-as-a-service** platform operated by **TA542**, spread largely through phishing, malicious Office attachments, thread hijacking, compromised WordPress sites, and direct IP-based C2, and linked it to downstream payloads including **TrickBot**, **QakBot**, **Dridex**, **Conti**, and **Ryuk**.
Aug 15, 2026
Researchers published proof-of-concept tooling to deobfuscate **Nymaim** malware, showing how analysts can recover cleaner code and improve reverse engineering in **IDA Pro**. One GitHub project, **Nymaim deobfuscation**, uses **miasm** for emulation and **grap** for graph-pattern matching to identify and patch common Nymaim obfuscation routines such as `push_reg`, `detour_call`, and `detour_jmp`, then generates an IDA script to rename functions and produce a cleaned sample. A related Bitbucket project, **Patchwork**, was built to demonstrate malware deobfuscation against the same malware family inside IDA using a modified **PyEmu** engine. The author described upgrades including stronger memory management, better support for uncommon x86 instructions, and a Python 2.7-compatible rebuild of **pydasm**, alongside setup guidance for loading Nymaim samples and running the deobfuscation workflow, underscoring a broader effort to automate analysis of heavily obfuscated Nymaim binaries.
Aug 15, 2026
**Emotet** developed from a banking trojan targeting German, Austrian, and later Swiss banks into a modular malware platform used for credential theft, spam propagation, and follow-on intrusion activity. Early and mid-stage variants were commonly delivered through phishing emails, malicious links, macro-enabled Office files, or JavaScript downloaders, then established persistence, injected into processes, harvested host and email data, and communicated with hard-coded or encrypted command-and-control infrastructure using protected configurations and encrypted traffic. Researchers documented repeated anti-analysis upgrades, including debugger and sandbox checks, abuse of the Windows `CreateTimerQueueTimer` API, fake or obfuscated C2 data, and repeated self-updates designed to frustrate reverse engineering. Later Emotet campaigns added stronger camouflage on both the wire and in the binary, with more RFC-compliant HTTP traffic, randomized URIs, and a redesigned configuration scheme that split obfuscated C2 addresses across multiple functions instead of storing a single encrypted blob. Incident responders also observed Emotet acting as an **initial access broker**: in one enterprise intrusion, a phishing-delivered Excel file installed Emotet, which spread via email, then downloaded **Cobalt Strike** and enabled credential dumping, Kerberoasting, lateral movement, remote-access tool deployment, and data exfiltration with **Rclone** to **MEGA**, stopping only before likely ransomware deployment. The reporting shows Emotet’s progression from banking malware into a resilient access-and-delivery ecosystem that supports broader post-compromise operations, including combinations with threats such as **Trickbot** and **Ryuk**.
Aug 15, 2026