Teoderick Contreras's Blog Posts

Teoderick Contreras

I'm a Senior Threat Research Engineer on Splunk's Threat Research Team. I've been working in the cybersecurity industry for almost 12+ years. I primarily focus on malware reverse engineering/analysis, digital forensics and detection development.

Behind the Code: The Layered Defense-Evasion of VIP Keylogger
Security
15 Minute Read

Behind the Code: The Layered Defense-Evasion of VIP Keylogger

The Splunk Threat Research Team analyzes the VIP Keylogger malware. Learn about its evasion tactics, including obfuscation and steganography, to improve your detection and threat-hunting strategies.
Behind the Walls: Techniques and Tactics in Castle RAT Client Malware
Security
10 Minute Read

Behind the Walls: Techniques and Tactics in Castle RAT Client Malware

Uncover CastleRAT malware's techniques (TTPs) and learn how to build Splunk detections using MITRE ATT&CK. Protect your network from this advanced RAT.
Hide Me Again: The Updated Multi-Payload .NET Steganography Loader That Includes Lokibot
Security
10 Minute Read

Hide Me Again: The Updated Multi-Payload .NET Steganography Loader That Includes Lokibot

An analysis on the updated .NET steganography loader delivering Lokibot malware, including evasion techniques, MITRE ATT&CK TTPs, and Splunk detections to enhance threat identification.
From Prompt to Payload: LAMEHUG’s LLM-Driven Cyber Intrusion
Security
10 Minute Read

From Prompt to Payload: LAMEHUG’s LLM-Driven Cyber Intrusion

The Splunk Threat Research Team analyzes the LAMEHUG malware, examining its tactics and techniques to provide insights that can help SOC analysts and blue teamers identify and respond.
Picture Paints a Thousand Codes: Dissecting Image-Based Steganography in a .NET (Quasar) RAT Loader
Security
13 Minute Read

Picture Paints a Thousand Codes: Dissecting Image-Based Steganography in a .NET (Quasar) RAT Loader

Uncover how to identify malicious executable loaders that use steganography to deliver payloads such as Quasar RAT.
When Installers Turn Evil: The Pascal Script Behind Inno Setup Malware Campaign
Security
16 Minute Read

When Installers Turn Evil: The Pascal Script Behind Inno Setup Malware Campaign

Uncover the Inno Setup malware campaign leveraging Pascal scripting to deliver RedLine Stealer.