Ex-Technical Support Specialist turned Advanced Threat Researcher.
I build high-performance, autonomous pipelines to track malware from GitHub repositories down to the final payload execution.
My current ecosystem is a fully automated, asynchronous malware analysis factory.
- ⚡ High-Speed Recon: Built with
httpxfor asynchronous scanning, enabling rapid discovery of malicious repositories at scale. - 🔬 Deep Payload Tracking: End-to-end tracking from initial repo discovery to payload extraction and C2 infrastructure mapping.
- 🧠 Intelligent Clustering: Autonomous clustering of threats based on behavioral patterns and campaign characteristics.
- 🛡️ Verification & De-obfuscation: * Cross-Check Engine: Validates findings across multiple repositories.
- Hash-Based Verification: Identifies and verifies obfuscated JS files through global hash comparisons.
- 🌐 Network & Dynamic Analysis: * Selenium Wire: Real-time network traffic interception and analysis of malware stage-loaders.
- Automated Sandboxing: Direct feeding to VirusTotal for behavioral analysis and automated screenshot capture.
- Languages: Python (Asyncio, Httpx), Bash, YARA.
- Tools: Selenium Wire, VirusTotal API, Hybrid Analysis, Docker.
- Methodologies: Malware Clustering, Network Traffic Analysis, Heuristic & ML Ensemble Detection.
- Infrastructure: Cloudflare Zero Trust, Secure CI/CD Pipelines, Automated Logging.
core/: Async scanners (httpx), ML classifiers, and Selenium Wire integrators.pipeline/: Automated clustering and VirusTotal feeding modules.data/: Real-time C2 intel, verified hashes, and automated analysis screenshots.
- 🛰️ Telegram CTI Integration: Automated monitoring of encrypted threat intelligence channels.
- 📊 Intel Dashboard: A centralized UI to visualize real-time campaign clusters and network graphs.
Ex-Technical Support Specialist. I bring a high level of troubleshooting expertise, system reliability focus, and corporate professionalism to every project I build.
| Patreon | X (Twitter) | Portfolio |
|---|
"Turning raw repository data into actionable threat intelligence, asynchronously."