dfir.ch | dfir.ch

Technical blog by Stephan Berger (@malmoeb)

Long term memory of my research and Incident Response stories

Recent Posts

Fantastic clear-text passwords and where to collect them (Part 2 - Windows)

29 Jun 2026

Fantastic clear-text passwords and where to collect them (Part 1 - Linux)

22 Jun 2026

Anatomy of a Deno-Based Proxy & RAT

15 Jun 2026

Dissection of a PHP Backdoor leveraging php-win.exe

16 Nov 2025

Today I learned: binfmt_misc

30 Oct 2025