Ayush Singh
Malware Analyst · Reverse Engineer · Threat Researcher
Based in Jamshedpur, Jharkhand, India · x86/x64 Assembly · IDA Pro · x64dbg · MITRE ATT&CK
Get in Touch
Summary
I don't just watch how software runs — I tear it down at the assembly level to see exactly how it breaks, evades, and infects. My core focus is on Malware Analysis and Reverse Engineering, with a deep fascination for Windows Internals and binary manipulation. Rather than relying on automated scanning, I treat malware analysis as a deep-dive investigation — isolating malicious code, bypassing anti-debugging tricks, and decoding obfuscated binaries to map out their exact intent and mechanics.
I actively build and document my research in public. My process involves taking live or simulated malware samples through rigorous static and dynamic analysis pipelines, tracing Windows API calls, analyzing PE headers, and capturing behavioral indicators to extract actionable Indicators of Compromise (IoCs). I am driven by deep curiosity and relentless consistency to understand the mechanics of a threat.
I am currently looking to connect with Threat Intelligence and Malware Research teams for remote internship opportunities where I can apply my analysis workflow to production environments. My goal is to contribute to real-world threat detection and response by bringing disciplined reverse engineering methodology, PE structural analysis, and behavioral tracking into professional security operations. If you are building a team focused on malware research, threat hunting, or vulnerability analysis, I am ready to bring my skills in IDA Pro, Ghidra, x64dbg, YARA rule generation, and MITRE ATT&CK mapping to the table.
Connect with me on Medium (@ayush.malwarex), Substack (ayushmalwarex), or X (@ayush_malwarex) for ongoing write-ups and research notes. You can also reach me directly at [email protected].
50+ Malicious Components
Successfully isolated through advanced static and dynamic analysis of complex binaries
100% IoC Extraction
High-fidelity Indicators of Compromise extracted across all analyzed samples
Public Research
Comprehensive reverse engineering write-ups and YARA signatures documented publicly
Top Skills
These three core competencies form the foundation of my malware research workflow. Each skill is applied in combination during real-world analysis engagements — from initial triage of untrusted executables through final threat documentation and IoC extraction.
Virus Removal
Identifying and neutralizing malicious software at the system level, including registry modifications, persistence mechanisms, and file-based payloads. This involves understanding how malware establishes footholds on compromised hosts, how it maintains persistence across reboots, and how to safely remove all traces without damaging legitimate system files or user data.
Malware Analysis
Conducting both static and dynamic analysis on suspicious binaries to understand behavior, capabilities, and infection vectors. Static analysis examines the binary without execution — inspecting PE headers, import/export tables, strings, and embedded resources. Dynamic analysis runs the sample in a controlled sandbox environment, monitoring API calls, file system changes, network connections, and registry activity to capture real-time behavioral indicators.
Program Analysis
Reverse engineering compiled executables to trace execution flows, identify anti-analysis routines, and decode obfuscated logic. This includes stepping through disassembled code in debuggers like x64dbg, identifying control flow obfuscation, unpacking packed binaries, and reconstructing the original program logic to understand exactly what the malware does at each stage of execution.
Together, these skills enable a complete threat analysis pipeline: from initial sample acquisition and triage, through deep reverse engineering and behavioral profiling, to final documentation of findings and generation of detection rules that can be deployed in production security environments.
Technical Toolkit
My toolkit spans industry-standard reverse engineering platforms, network analysis utilities, programming languages, and structured threat intelligence methodologies. Each tool plays a specific role in my analysis pipeline, from initial static triage through dynamic behavioral monitoring and final threat documentation. I rely on these tools daily across every engagement, whether analyzing Windows PE executables, Android APK packages, or network traffic captures from live malware samples.
Analysis Tools
  • IDA Pro — Interactive Disassembler for deep static analysis of complex binaries, including control flow graph visualization and cross-referencing
  • Ghidra — NSA's open-source reverse engineering suite for decompilation, scriptable analysis, and collaborative reverse engineering
  • x64dbg — Windows-native debugger for dynamic analysis, stepping through assembly instructions, setting breakpoints, and inspecting memory at runtime
  • Sysinternals Suite — Process Monitor and Process Hacker for real-time monitoring of file system, registry, and process activity during malware execution
  • Wireshark — Network protocol analyzer for deep packet inspection, capturing C2 communication, and extracting network-based IoCs
  • JADX-GUI — Android decompiler for reverse engineering APK packages, performing bytecode disassembly, and verifying AndroidManifest.xml entries
Languages
  • x86/x64 Assembly — Low-level instruction analysis for Windows binaries, understanding calling conventions, stack operations, and register-level manipulation
  • C / C++ — Systems-level programming for understanding memory management, pointer arithmetic, and how high-level code compiles down to assembly
  • Python — Automation scripts for PE parsing, YARA rule generation, IoC extraction, and building custom analysis pipelines to accelerate repetitive triage tasks
Methodologies
  • Static Binary Analysis — examining binaries without execution to identify structure, imports, strings, and embedded resources
  • Dynamic/Behavioral Analysis — running samples in sandboxed environments to observe runtime behavior, API calls, and system changes
  • PE File Structure Verification — parsing Portable Executable headers, section tables, and import/export directories
  • Anti-Analysis & Obfuscation Bypass — defeating anti-debugging tricks, unpacking packed binaries, and decoding obfuscated strings
  • YARA Rule Generation — writing scalable detection signatures based on observed patterns and behavioral indicators
  • MITRE ATT&CK Mapping — translating threat capabilities to standardized tactic and technique identifiers
Analysis Methodologies
My malware research workflow follows a structured, multi-phase pipeline that moves from initial sample triage through deep reverse engineering and final threat documentation. Each phase builds on the previous one, ensuring that no behavioral indicator or structural artifact goes unexamined. This methodology has been refined through hands-on analysis of over 50 unique malicious components, and it consistently delivers high-fidelity IoCs and comprehensive threat write-ups.
The first phase, Static Analysis, involves examining the binary without executing it. I parse PE headers to understand the file structure, analyze import and export tables to identify which Windows APIs the malware depends on, extract strings to find embedded URLs or commands, and use IDA Pro or Ghidra to disassemble the code and map out control flow. This phase often reveals packing, obfuscation, or anti-analysis routines that need to be bypassed before deeper analysis can proceed.
The second phase, Dynamic Analysis, runs the sample in a controlled sandbox environment. Using x64dbg, I step through assembly instructions, set breakpoints on critical API calls, and inspect memory and register states at runtime. Sysinternals Process Monitor captures every file system change, registry modification, and process creation event, while Wireshark records all network traffic to identify command-and-control communication patterns.
The third phase, Behavioral Profiling, synthesizes the data collected during dynamic analysis into concrete Indicators of Compromise. I extract file hashes, IP addresses, domain names, mutex names, registry keys, and behavioral patterns. I then engineer custom YARA signatures that can detect this malware family or its variants in future scanning operations.
The final phase, Threat Documentation, maps all observed threat capabilities to the MITRE ATT&CK framework, assigning tactic and technique identifiers to each behavior. I document the full analysis in public write-ups, ensuring that the broader security community can benefit from the findings and that detection rules are shared for operational use.
Experience
June 2026 – Present · 1 Month · Jamshedpur
Independent Malware Researcher & Reverse Engineer
Working independently as a self-employed malware researcher, I have built a comprehensive public research portfolio that demonstrates end-to-end threat analysis capability. My work spans static and dynamic binary analysis, network profiling, mobile threat intelligence, and scalable detection rule engineering. Every analysis is documented and shared publicly, contributing to the broader security community's understanding of active threats.
Static & Dynamic Binary Analysis
Accomplished advanced static and dynamic analysis on complex binaries, as measured by the successful isolation of over 50 unique malicious components. This involved reverse engineering via IDA Pro, Ghidra, and x64dbg to map execution flows, identify anti-analysis routines, and decode obfuscated logic. Each sample was subjected to rigorous PE header analysis, import table parsing, and runtime debugging to fully understand its capabilities and infection mechanics.
Threat Behavioral Tracking & Network Profiling
Accomplished end-to-end threat behavioral tracking and network profiling, as measured by a 100% success rate in extracting high-fidelity Indicators of Compromise (IoCs). This involved deep packet analysis using Wireshark to capture C2 communication patterns, and monitoring runtime processes via Sysinternals ProcMon to track file system, registry, and process-level changes during malware execution in sandboxed environments.
Detection Rules & Threat Documentation
Accomplished the generation of scalable detection rules and technical threat documentation, as measured by a comprehensive public repository of reverse engineering write-ups. This involved engineering custom YARA signatures based on observed patterns and mapping threat capabilities directly to the MITRE ATT&CK framework, providing standardized tactic and technique identifiers for each observed behavior.
Automated PE Structural Evaluation
Accomplished automated structural evaluation of compiled software, as measured by rapid triage of untrusted executables. This involved analyzing Portable Executable (PE) headers, parsing import and export tables, and building custom Python automation scripts to detect packing or obfuscation — significantly accelerating the initial triage phase of each analysis engagement.
Mobile Threat Intelligence
Accomplished mobile threat intelligence gathering, as measured by the identification of suspicious behavior within application-layer Android applications. This involved reverse engineering compiled APK packages using JADX-GUI to perform bytecode disassembly and AndroidManifest.xml verification, uncovering hidden permissions, embedded payloads, and suspicious network endpoints.
Certifications & Continuous Learning
I hold a certification from the PortSwigger Web Security Academy, one of the most respected platforms for web application security training. PortSwigger's curriculum covers a comprehensive range of web vulnerabilities — from SQL injection and cross-site scripting to server-side request forgery and access control flaws — providing hands-on labs that mirror real-world attack scenarios. This certification demonstrates my commitment to understanding the full spectrum of attack surfaces, including the web layer that malware often uses for initial access, command-and-control communication, and data exfiltration.
Beyond formal certifications, my learning is continuous and deeply practical. I actively publish my research findings on Medium (@ayush.malwarex), Substack (ayushmalwarex), and X (@ayush_malwarex), where I document reverse engineering walkthroughs, malware analysis write-ups, and technical deep-dives into Windows Internals and binary manipulation. These public write-ups serve as both a learning record and a contribution to the broader security community, ensuring that the techniques and IoCs I uncover are accessible to other researchers and defenders.
My approach to professional development is rooted in hands-on engagement with live and simulated malware samples. Rather than relying solely on structured courses, I learn by doing — taking real-world samples through my full analysis pipeline, from static triage through dynamic behavioral profiling to final MITRE ATT&CK mapping. This practical methodology ensures that my skills remain sharp and directly applicable to the threats that organizations face today. I am committed to maintaining this cycle of analysis, documentation, and public sharing as I grow into a professional malware research role.
PortSwigger Web Security Academy
Certified in web application security testing, vulnerability identification, and exploitation techniques across the full OWASP Top 10 and beyond
Public Research Portfolio
Ongoing reverse engineering write-ups, malware analysis reports, and technical documentation published on Medium, Substack, and X
Hands-On Methodology
Continuous learning through live sample analysis, PE structural evaluation, YARA rule engineering, and MITRE ATT&CK mapping in real-world contexts
Education
My academic background provides a strong foundation in the scientific and technical principles that underpin cybersecurity research. From early science education through university-level study, I have consistently pursued coursework and self-directed learning that connects directly to my work in malware analysis, reverse engineering, and threat intelligence.
1
Class 10th · Science
Kendriya Vidyalaya (KV)
April 2020 – March 2021
2
Class 12th · Science
Kendriya Vidyalaya (KV)
April 2022 – March 2023
3
University Studies
Sardar Beant Singh State University (SBSSU), Gurdaspur
2024
The Kendriya Vidyalaya system provided a rigorous foundation in science and mathematics, establishing the analytical thinking skills that are essential for reverse engineering and binary analysis. At Sardar Beant Singh State University (SBSSU) in Gurdaspur, I continued building on this foundation while simultaneously pursuing independent malware research. My university studies complement my self-directed learning in x86/x64 assembly, Windows Internals, and PE file structure — subjects that I study through hands-on analysis of real malware samples rather than traditional coursework alone.
What distinguishes my educational path is the parallel development of practical cybersecurity skills alongside formal academics. While pursuing my degree, I was simultaneously conducting static and dynamic malware analysis, building Python automation scripts for PE parsing, engineering YARA detection rules, and documenting my findings in public write-ups. This combination of structured education and real-world research experience has prepared me to contribute immediately to professional threat intelligence and malware research teams.
I am actively seeking remote internship opportunities with Threat Intelligence and Malware Research teams where I can apply this combination of academic grounding and hands-on analysis experience to production security environments. My goal is to continue growing as a researcher while contributing to real-world threat detection, incident response, and vulnerability analysis operations.
Portfolio & Online Presence
I believe in building in public. My research, write-ups, and analysis findings are actively shared across multiple platforms, making my work transparent and accessible to the broader security community. Whether you are a hiring manager evaluating my capabilities, a fellow researcher looking to collaborate, or a security team seeking threat intelligence contributions, my online presence provides a comprehensive view of my analytical approach and technical depth.
Email
[email protected]
Primary contact for internship inquiries, collaboration proposals, and professional outreach. I respond promptly to messages from threat intelligence teams, security researchers, and organizations seeking malware analysis expertise.
LinkedIn
linkedin.com/in/ayush-malwarex/
Professional profile showcasing certifications, skills endorsements, and career history. Connect to stay updated on my latest research contributions and professional milestones in the malware analysis space.
Sketch Portfolio
ayush-singh-
Visual portfolio showcasing the depth and range of my reverse engineering and malware research work. A curated view of my most significant analysis projects and technical write-ups.
Gamma Portfolio
cybersecurit-20sj1m6.gamma.site
Interactive portfolio built on Gamma, presenting my research findings, analysis methodologies, and threat intelligence contributions in a structured, visual format designed for security professionals and hiring teams.
In addition to these platforms, I actively publish long-form research on Medium (@ayush.malwarex), Substack (ayushmalwarex), and X (@ayush_malwarex). These channels feature in-depth reverse engineering walkthroughs, malware analysis write-ups, and technical commentary on Windows Internals, binary manipulation, and emerging threat actor TTPs. Following these platforms is the best way to stay current with my latest findings and analytical perspectives.
Let's Connect
I am actively seeking remote internship opportunities with Threat Intelligence and Malware Research teams. My goal is to apply my analysis workflow — built around static and dynamic binary analysis, PE structural evaluation, behavioral profiling, YARA rule generation, and MITRE ATT&CK mapping — to production security environments. I am ready to contribute immediately to threat hunting operations, malware triage pipelines, and incident response workflows.
What I bring to a team is not just technical skill in tools like IDA Pro, Ghidra, and x64dbg, but a disciplined methodology for understanding threats from the ground up. I isolate malicious code, bypass anti-debugging tricks, decode obfuscated binaries, trace Windows API calls, and extract actionable IoCs — then document everything in structured write-ups that map threat capabilities to the MITRE ATT&CK framework. My public research portfolio demonstrates this end-to-end capability across over 50 unique malicious components, with a 100% success rate in IoC extraction.
If you are building or scaling a malware research, threat intelligence, or vulnerability analysis team, I would welcome the opportunity to discuss how my skills and methodology can support your mission. Whether you need someone to triage new samples, reverse engineer complex binaries, engineer detection rules, or contribute to threat reports — I am ready to engage.
💼 LinkedIn
linkedin.com/in/ayush-malwarex/
🐙 GitHub
Yet to be Publish in Public
📝 Medium / Substack / X
@ayush.malwarex · ayushmalwarex · @ayush_malwarex
Made with