TekCookie75 Blog - A basic blog about malware analysis, identity, and cloud https://tekcookie75.github.io/ A high-level walkthrough down the LLM pipeline from prompt to Prediction - In the late 2025 to the beginning of 2026 the usage of AI, especially the usage of Large Language Models (LLMs), became more and more prominent. With the two major contributions of OpenClaw and Claude Code agentic AI systems (so called AI assistents) become accessible to the public. Due to... Sat, 28 Mar 2026 00:00:00 +0100 https://tekcookie75.github.io/2026-03-28-From-Prompt-to-Prediction/ https://tekcookie75.github.io/2026-03-28-From-Prompt-to-Prediction/ Using Claude Code Skills to automate the inital static file triage - Following the social media, regardless wether you are on X, LinkedIn or Instagram, everyone talks about Agentic AI and Claude Code. The post scoping from the perfect prompt to just another fancy Skill. The people going crazy and trying to approach every problem with AI, especially LLMs, regardless of the... Tue, 24 Mar 2026 00:00:00 +0100 https://tekcookie75.github.io/2026-03-24-AgenticAI-Triage-Pipeline/ https://tekcookie75.github.io/2026-03-24-AgenticAI-Triage-Pipeline/ Analysing a ransomware sample from the HackTheBox LovelyMalware CTF - In the recent decade many companies were hit by small to large scale ransomware incidents. From malware perspective ransomware does challenge us with an interessting obstacle. If we try to mount a dynamically analysis against the sample, i.e., executing it inside the sandbox, we may end up to encrypt our... Fri, 20 Feb 2026 00:00:00 +0100 https://tekcookie75.github.io/2026-02-20-LovelyMalware-Ransomware-CTF/ https://tekcookie75.github.io/2026-02-20-LovelyMalware-Ransomware-CTF/ Speed up your Reverse Engineering Workflows using Emulation - Embedded strings are propably the most valuable indicators to get a fast insight of an applications capabilities. Thus, a typical statical initial triage of a PE-file starts by checking the imports, the exports and the embedded strings. However nearly all well designed modern malware will protect these strings by applying... Sun, 15 Feb 2026 00:00:00 +0100 https://tekcookie75.github.io/2026-02-15-Quiling-string-deobfuscation/ https://tekcookie75.github.io/2026-02-15-Quiling-string-deobfuscation/ Analyzing a Lunar Stealer Sample - Abstract From time to time I browse teh database of Malware Bazare to get a feeling about current developments in the field of malware. In the last month I felt the subjective rise of python based malware. The later motivated me to took a look at python based malware an... Mon, 12 Jan 2026 00:00:00 +0100 https://tekcookie75.github.io/2026-01-12-Python-Malware-on-the-rise/ https://tekcookie75.github.io/2026-01-12-Python-Malware-on-the-rise/ Analyzing a ClickFix Campaign - During the late 2024 and early 2025 a new social engineering threat became more and more famous. In the so called ClickFix attack a user is tricked into running malicious code by executing code placed by the adversary into the users clipboard via the Windows Run Dialog (Win+R). The common... Mon, 01 Sep 2025 00:00:00 +0200 https://tekcookie75.github.io/2025-09-01-Analyzing-a-ClickFix-Campaign/ https://tekcookie75.github.io/2025-09-01-Analyzing-a-ClickFix-Campaign/ My opinion on Performance, compatibility, and real-world security workflows - During my study times I observed that many of the professors, especially from the computer science departments, were using Apple devices. At that time the majority of Apple devices were powered by Intel processors. Since then a lot changed and nowadays all Apple devices were produces with Apple Silicon chips... Mon, 17 Mar 2025 00:00:00 +0100 https://tekcookie75.github.io/2025-03-17-Apple-Silicon-for-Security-Analysts/ https://tekcookie75.github.io/2025-03-17-Apple-Silicon-for-Security-Analysts/ Waifu University targeted by BackCat ransomware (CTF write-up) - XINTRA Labs: Waifu University targeted by BlackCat ransomware In this blog post I will walk through the process of investigating the “ransomware attack on Waifu university” scenario from the XINTRA advanced APT emulation platform. This scenario is a beginner one and can be accessed for free using XINTRA 7 day... Sun, 15 Dec 2024 00:00:00 +0100 https://tekcookie75.github.io/2024-12-15-XINTRA-Labs-Waifu-University/ https://tekcookie75.github.io/2024-12-15-XINTRA-Labs-Waifu-University/ Volatile Memory Analysis on KG Distribution - Lab Description In this blog post I will deal with a very beginner friendly lab created by 13CubedDFIR. The lab was created for the amazing forensic and DFIR training and challenge platform XINTRA. To access the challenge, the paid subscription of XINTRA is required, which is in my opinion absolutely... Sat, 16 Nov 2024 00:00:00 +0100 https://tekcookie75.github.io/2024-11-16-XINTRA-Memory-Analysis-on-KG-Distribution/ https://tekcookie75.github.io/2024-11-16-XINTRA-Memory-Analysis-on-KG-Distribution/ Deploying your own gitea from code - Infrastructure as Code: Gitea meets Fedora CoreOS Abstract Infrastructure as code (IaC) uses DevOps methodology and versioning with a descriptive model to define and deploy infrastructure. Just as the same source code always generates the same binary, an IaC model generates the same environment every time it deploys. In this... Thu, 03 Oct 2024 00:00:00 +0200 https://tekcookie75.github.io/2024-10-03-Infrastructure-as-Code-gitea-meets-coreOS/ https://tekcookie75.github.io/2024-10-03-Infrastructure-as-Code-gitea-meets-coreOS/