Rogue_Binary // Triage_Mode
Process_01: Overview

Rogue Binary.

[agent_runtime] Decoupled binary analysis and decompiler MCP servers for AI agents. Focused, token-efficient malware triage returning bounded tool output instead of raw decompiler dumps.

Initialize_Wiki View_Repositories
agent / rbin
connected

$ agent: open persistent rbinr2 session and query functions

> r2_open {"binary_path":"/samples/app.exe"}

> r2_metadata {"binary_path":"/samples/app.exe", "mode":"functions"}

r2_metadata.functions.v0
0x140001080 sym.main (182 bytes, 12 blocks)
0x1400018d0 sym.decrypt_payload (310 bytes, 24 blocks)
0x1400021e0 sym.resolve_exports (140 bytes, 8 blocks)

$ agent: request targeted function decompilation from rbinghidra

> ghidra_decompile {"binary_name":"app.exe", "function_address":"0x1400018d0"}

Stdio Pipe bounded JSON cached backends
Process_02: Capabilities

[rbinghidra mcp]

A Model Context Protocol server for Ghidra-based binary analysis. Employs analyzeHeadless for sub-second cached queries of callsites, CFGs, decompiler output, and type definitions.

[rbinr2 mcp]

A Model Context Protocol server for radare2-based binary analysis. Exposes 39 specialized tools managing persistent r2pipe sessions for focused disassembly and symbol tracing.

[rbinilspy mcp]

A Model Context Protocol server for ILSpyCmd-based .NET decompilation. Outlines types, searches managed metadata, and returns focused C# or IL member bodies without dumping assemblies.

[Token-efficient triage]

Get hashes, file shape, imports, sections, strings, hardening posture, call structure, and likely behavior families before an agent spends context on a backend.

Data_Feed: Derp.ca_Research
View_All

Jul 21, 2026

1,509 WordPress sites feed an active SocGholish chain

One integrated WordPress-to-GhoLoader operation mapped to Proofpoint's TA2726 and TA569/SocGholish labels, followed by ClickFix on shared hosts.

Jul 14, 2026

From EtherHiding to a native RAT: ClickFix on new-blog.artlist[.]io

Static teardown of a ClickFix chain on new-blog.artlist[.]io, from Polygon EtherHiding and PowerShell delivery to a manually mapped native Windows RAT.

Jun 21, 2026

SilverFox-style loader chain: Panasonic shells, Alibaba OSS carriers, and a Sauron backdoor

Technical analysis of a SilverFox-style loader chain hiding behind Panasonic PC Notification metadata, using Alibaba OSS carriers, signed side-load hosts, RPC Task Scheduler staging, and a Sauron backdoor.

Process_03: Secure_Comms

Contact Rogue Binary.

[submit_query] Rogue Binary tool feedback, binary-analysis tooling, malware triage, and private consulting.