Hassan Raza

Self-employed Malware Researcher

Self Employed • Trabajador autónomo

Jul 2023 - Present • 3 yrs 3 mos

I worked independently as a malware researcher, focusing on reverse engineering and behavioral analysis of Windows malware. My work involved static and dynamic analysis of PE files, tracing execution, understanding Windows API usage, unpacking/obfuscation, persistence mechanisms, process injection, networking and C2 behavior, and extracting IOCs and technical findings. I used tools including IDA Pro, Ghidra, Binary Ninja, x64dbg, WinDbg, Detect It Easy (DIE), PE-bear, FLOSS, capa, YARA, and Sysinternals (ProcMon, Process Explorer, Autoruns) for analysis and triage. For controlled execution and behavioral testing, I worked with FLARE-VM, REMnux, CAPE/Cuckoo, ANY.RUN, Wireshark, FakeNet-NG, and INetSim, using isolated virtual machines and snapshots for safe analysis. I also used scripting and automation where appropriate to speed up repetitive analysis and compare samples. During 2023–2025, my research covered families and campaigns such as LockBit, BlackCat/ALPHV, QakBot, IcedID, RedLine, Vidar, Lumma Stealer, and BatLoader, among others.