SentinelLabs Logo RGB WhitePurp
ABOUT
CVE DATABASE
CONTACT
VISIT SENTINELONE.COM

Jason Reaves

Jason Reaves is a Principal Threat Researcher at SentinelLabs who specializes in malware reverse-engineering. He has spent the majority of his career tracking threats in the Crimeware domain, including reverse-engineering data structures and algorithms found in malware in order to create automated frameworks for harvesting configuration and botnet data. Previously, he worked as a software developer and unix administrator in the financial industry and also spent six years in the U.S. Army. Jason holds multiple certifications related to reverse-engineering and application exploitation and has published numerous papers on topics such as writing malware scripts pretending to be a bot, unpackers, configuration data harvesters and covert channel utilities. He enjoys long walks in IDA and staring at RFCs for hours.
Anchor Project For Trickbot Adds ICMP
Crimeware

Anchor Project for Trickbot Adds ICMP

Jason Reaves / October 29, 2020

The team behind Trickbot has been aggressively updating and deploying various modules including Anchor and Bazar Loader targeting high-value targets, including healthcare entities

Read More
Enter The Maze  Demystifying An Affiliate Involved In Maze Snow 9
Crimeware

Enter the Maze: Demystifying an Affiliate Involved in Maze (SNOW)

Jason Reaves / July 22, 2020

SentinelLabs profiles an affiliate involved with Maze ransomware and details the actor’s involvement with other crimeware families, including TrickBot.

Read More
Breaking EvilQuest Reversing A Custom MacOS Ransomware File Encryption Routine 8
Security Research

Breaking EvilQuest | Reversing A Custom macOS Ransomware File Encryption Routine

Jason Reaves / July 7, 2020

A new macOS ransomware threat uses a custom file encryption routine not based on public key encryption. Jason Reaves shows how we broke it.

Read More
Valak Malware And The Connection To Gozi Loader ConfCrew 1
Crimeware

Valak Malware and the Connection to Gozi Loader ConfCrew

Jason Reaves / June 9, 2020

Valak uses a multi-stage, script-based malware that hijacks email replies and embeds malicious URLs or attachments to infect devices with fileless scripts.

Read More
Sarwent Malware Continues To Evolve With Updated Command Functions 6
Security Research

Sarwent Malware Continues to Evolve With Updated Command Functions

Jason Reaves / May 21, 2020

Sarwent has received little attention from researchers, but this backdoor malware is still being actively developed, with new commands and a focus on RDP.

Read More
Deep Dive Into TrickBot Executor Module “mexec”  Reversing The Dropper Variant 7
Crimeware

Deep Dive Into TrickBot Executor Module “mexec”: Reversing the Dropper Variant

Jason Reaves / May 14, 2020

Continuing our earlier analysis of the TrickBot Executor Module “mexec”, we take a look at the dropper variant and reveal how it carries its payload onboard.

Read More
Deep Dive Into TrickBot Executor Module Mexec Hidden Anchor Bot Nexus Operations 4
Crimeware

Deep Dive Into TrickBot Executor Module “mexec”: Hidden “Anchor” Bot Nexus Operations

Jason Reaves / April 8, 2020

New “mexec” module delivers tertiary malware and allows TrickBot to pivot within a network, deploy a variety of payloads and evade common detection methods.

Read More
Breaking TA505s Crypter With An SMT Solver 1
Advanced Persistent Threat

Breaking TA505’s Crypter with an SMT Solver

Jason Reaves / March 4, 2020

TA505 threat group use a crypter common to Clop/CryptoMix ransomware and others. We tear it down with a new unpacker utilizing SMT.

Read More
Revealing The Trick   A Deep Dive Into TrickLoader Obfuscation 2
Crimeware

Revealing the Trick | A Deep Dive into TrickLoader Obfuscation

Jason Reaves / February 26, 2020

TrickBot’s loader has received much less attention than other components of the malware. Jason Reaves shows how to reverse engineer the TrickLoader function.

Read More

SentinelLabs

In the era of interconnectivity, when markets, geographies, and jurisdictions merge in the melting pot of the digital domain, the perils of the threat ecosystem become unparalleled. Crimeware families achieve an unparalleled level of technical sophistication, APT groups are competing in fully-fledged cyber warfare, while once decentralized and scattered threat actors are forming adamant alliances of operating as elite corporate espionage teams.

Recent Posts

  • FreeDrain Unmasked | Uncovering an Industrial-Scale Crypto Theft Network
    FreeDrain Unmasked | Uncovering an Industrial-Scale Crypto Theft Network
    May 8, 2025
  • Top Tier Target | What It Takes to Defend a Cybersecurity Company from Today’s Adversaries
    Top Tier Target | What It Takes to Defend a Cybersecurity Company from Today’s Adversaries
    April 28, 2025
  • AkiraBot | AI-Powered Bot Bypasses CAPTCHAs, Spams Websites At Scale
    AkiraBot | AI-Powered Bot Bypasses CAPTCHAs, Spams Websites At Scale
    April 9, 2025

Sign Up

Get notified when we post new content.

Thanks! Keep an eye out for new content!

  • Twitter
  • LinkedIn
©2025 SentinelOne, All Rights Reserved.