← Home
my skillset
 

I am a 19 year old independent malware analyst, malware removal expert, teacher, and computer science student from Czech Republic. I find fun in helping others and beating malware's ass!

I am open to all sorts of collaborations regarding malware removal, analysis or general cybersecurity topics. Shoot me a DM on one of my socials or email me at contact@rifteyy.org

Skills & Experience

Malware Disinfection

8+ years · 3,000+ people helped

Extensive knowledge in malware disinfection and remediation. Deep understanding of Windows OS, Sysinternals suite, FRST and in the past RSIT or HijackThis. Performed disinfections both physically and remotely, mostly by guiding users step by step.

As of today, you can find me helping primarily on r/computerviruses subreddit as a moderator and Malware Removal Expert or Malwarebytes Forums as an Expert.

Malware Analysis

Sandboxes · Reverse engineering · Report writing

Extensive experience using online sandboxes - VirusTotal, Triage, AnyRun, Hybrid Analysis and more. I am confident in reverse engineering and deobfuscating malware at a deeper level. My toolset includes Ghidra, x64dbg, dnSpy, DetectItEasy and many more.

Script Malware

Red teaming · Blue teaming

Strong red team knowledge around creating undetected, script-based malware - including implementing full payloads within initial script stages. This same knowledge makes me effective at deobfuscating and analysing multi-stage scripts defensively.

Teacher

Computer science · IT support

Teaching computer science and IT at primary and elementary school level. I handle technical support for everything falling under tech - 3D printers, laser wood cutters, and more. I educate teachers on how to use technology properly and how to optimize it to their gain and while teaching.

Notable work

Malware Blog · Discovery

TamperedChef / EvilAI Campaign

Discovered and wrote up a malware family falling under the TamperedChef/EvilAI campaign that went undetected for many years. The discovery at least temporarily disrupted their network - the threat actors shut down all discovered websites relevant to this variant.

Browse all analysis reports

Support my work