Case Studies

Two Silver Fox / ValleyRAT loader builds, one compiled a day before analysis. Dekeneas mapped the campaign architecture component by component from static structure — while the vendor that published the reference research returned Undetected.

Three samples collected during a real ransomware incident — an unknown encryptor, Mimikatz and Process Hacker. The one with the fewest flagged capabilities scored highest, by a factor of four. Dekeneas does not count.

Dekeneas classified a weaponised RTF exploit document as malicious at maximum risk from its structure alone — while CrowdStrike Falcon, SentinelOne, Malwarebytes and others returned Undetected on a publicly documented sample.

Dekeneas classified a publicly available implant as malicious at maximum risk while 53 of 70 VirusTotal engines returned Undetected. Five weeks later, 50 of 70 agreed.