static malware analysis
Drop a binary. Get extracted C2s, wallet addresses, Telegram tokens, mutex names, and encryption keys — no execution, no account.
230+malware families
<5sper analysis
3intel sources
freeno account needed
01
config extraction that actually works
Not heuristics. If the binary is AsyncRAT, you get the real C2 address, port, mutex, and encryption key the operator hardcoded in. XWorm, Remcos, Lumma, VenomRAT and 230+ other families. The data comes straight out of the binary — no execution required.
static only
02
three intel sources on every scan
Every upload runs against a static config extraction engine, a community YARA ruleset with thousands of signatures, and two global hash databases tracking known-malicious files. All three results in one report — matched rules, extracted configs, and IOC hits.
yara · hash intel · ioc feeds
03
your files disappear after analysis
Nothing gets stored on rosereverse servers. Files are processed and discarded. No accounts, no upload history, no cookies tracking you. Submit a sample and close the tab — that's it.
no retention
04
safe on samples you wouldn't execute
Pure static analysis — files are never run. No sandbox, no VM, no detonation. You can throw an active stealer at it without triggering anything. Useful for quick triage when spinning up an isolated environment isn't worth it.
non-executing
05
wider file type support than most tools
Full config extraction on PE and ELF binaries. Hash-based intel extends to DLLs, scripts, archives, and LNK files through the same interface — no switching tools.
.exe .msi .elf .bin .dll .ps1 .bat .zip +
static config extraction
drop file or browse
.exe.msi.elf.bin .dll.ps1.bat.cmd.vbs.py.js.lnk.zip
highlighted = full config extraction  ·  others = hash intel only  ·  max 100 MB
signature coverage
0 custom rules  +  community YARA intel  +  230+ family signatures ■ full extraction  ■ detection only
checking...
systems
analysis engine
—
threat feeds
—
signature database
—
activity
scans in last 24h
—
total scans processed
—
update history