We are RatGuard
We reverse-engineer malware, investigate malicious infrastructure, and report threat actors to blocklists and competent authorities.
Anonymous. Focused. Persistent.
We operate anonymously as RatGuard. Our work revolves around static and dynamic analysis of malicious binaries - stealers, RATs, fake clients, and malware disguised as legitimate software. We document findings, trace infrastructure, and push malicious domains to global blocklists.
No corporate affiliation. Just an independent research initiative.
Tools & Skills
Static analysis, dynamic analysis, and threat infrastructure research.
Threat Reports
Documented investigations resulting in domain takedowns and blocklist submissions.
Steam phishing operation using a fake Steam client executable. Upon launch, the binary displayed a fake error dialog and opened a WebView pointing to a credential harvesting page mimicking the Steam login interface. Investigated the infrastructure, documented the attack chain, and submitted to Spamhaus DBL and Google Safe Browsing. Domain is now fully blocked.
Malware distribution platform operating under the guise of game cheats. Binaries distributed through the site contained malicious payloads. The domain was investigated, reported, and successfully added to Spamhaus DBL. Currently returns 403 Forbidden - infrastructure neutralized.
Telegram channel distributing a malicious binder. Static analysis using dnSpy revealed a C# dropper extracting two executable files from its internal resources and dropping them into the %temp% folder. Subsequent dynamic analysis within dnSpy exposed the C2 domain, which was successfully submitted to the Spamhaus DBL.
Telegram channel distributing a Go-based dropper. Dynamic analysis in x64dbg and behavioral static analysis in IDA Pro confirmed the binary unpacks its primary malicious payload directly into the %temp%\lsass_helper.exe directory upon execution.
YouTube channel actively distributing the Overlord RAT. Dynamic analysis of the downloaded payload successfully identified the Command and Control (C2) IP address. The infrastructure was reported and is currently listed on the Spamhaus SBL.
Get in touch
Threat reports, tips, collaboration inquiries.