MadProtect, not that mad

This report analyzes the "MadProtect" packer that writes encrypted payloads in 0x10-byte chunks and unpacks a NetWire RAT via a simple RunPE technique. The author documents dynamic tracing observations, reverse-engineering steps to recover the AES-like key loop, a YARA rule, numerous sample hashes, C2 IPs and ports, mutex/filenames, and provides a decoding script and indicators for detection and hunting.