Executive Summary This analysis represents the second instalment in a comprehensive examination of the KorPlug malware family. Previous reporting detailed the initial loading vector utilising DLL side-loading techniques against legitimate utilities to achieve code execution. The second-stage payload executes via a designated entry point function. Static analysis of the binary reveals that the Initialise function, invoked by the preceding loader stage, exhibits an anomalous Control Flow Graph (

Executive Summary  In late May 2025, RevEng.AI identified a new sample of KorPlug (a.k.a Hodur) —a well-known Remote Access Trojan (RAT) frequently leveraged in targeted cyber-espionage campaigns—uploaded to a third-party file-scanning platform. This report is the first in a three-part series detailing a malware campaign involving KorPlug. This is the first of three reports describing a KorPlug campaign, detailing a three-stage malware-execution chain. The observed campaign detailed in this P

Reverse engineering malware often feels like solving a puzzle where half the pieces are hidden. Among the most common obstacles analysts face is string obfuscation—a technique where malware authors encrypt or encode strings to evade detection and frustrate analysis. This anti-analysis technique appears in virtually every modern malware family, turning what should be straightforward analysis into hours of tedious manual work. In this post, RevEng.AI will explore two approaches to dealing with th