🇹🇳 Tunis, Tunisia ICT Engineering Student @ ENIT

I break websites and reverse binaries for a living — and write down exactly how.

Reverse engineering, malware analysis and SOC automation. Solo-built a 9-stage, 5-phase nested-VM malware pipeline; ENIT placed 77th globally at HTB University CTF 2025.

Read the writeups CV github

Available for a 6-month internship from February 2027

Top 1%TryHackMe, globally
77thHTB University CTF 2025
10certifications
5production projects

0xmrerror@terminal:~$cat whoami.txt

About — whoami

0xmrerror@terminal:~/whoami.txt
Skandar Hadrich
handle
0xmrerror
location
Tunis, Tunisia 🇹🇳
affiliation
ENIT — ICT Engineering
focus
Malware Analysis · Reverse Engineering · Penetration Testing

I am Skandar Hadrich, an ICT Engineering student at ENIT specializing in cybersecurity, low-level systems, and ML-for-security. My research centers on automated malware analysis, reverse engineering, and threat research using GNNs, RL, and eBPF.

Most notably, I architected a 9-stage, 5-phase nested-VM malware analysis sandbox with live hypervisor eBPF tracing and Volatility3 VMI correlation.

I hold 10 certifications—including NVIDIA LLM Fine-Tuning and the CCEP cybersecurity educator credential—and maintain a Top 1% global ranking on TryHackMe along with a #77 global HTB Uni CTF team finish. My engineering expertise spans SOC automation, DevSecOps pipelines, network intrusion detection, and binary disassembly.

I am currently seeking a 6-month research internship starting early 2027 in systems security, binary analysis, or AI security.

TryHackMeTop 1%ranked globally
HTB University CTF 202577thENIT team, worldwide

0xmrerror@terminal:~$ls -la ./arsenal

Skills — skills

Reverse Engineering

  • Ghidra
  • Debugging (GDB + WinDbg)
  • Binary Instrumentation (Frida)
  • Android (JADX + Android Studio)

AI / ML

  • Graph neural networks (GCN/GAT)
  • LLM fine-tuning
  • Reinforcement learning algorithms (Monte Carlo)
  • PyTorch
  • TensorFlow
  • scikit-learn
  • OpenCV

SOC / Blue Team

  • Wazuh SIEM
  • Splunk
  • ELK
  • Windows & Linux threat detection
  • Shuffle SOAR
  • Detection rule engineering
  • IOC & log analysis
  • MITRE ATT&CK mapping

Programming

  • Python
  • C / C++
  • Assembly (x86, ARM)
  • C# / .NET
  • Bash
  • JavaScript

Infrastructure & DevSecOps

  • Docker
  • Ansible
  • CI/CD pipelines
  • REST APIs

Penetration Testing

  • Burp Suite
  • sqlmap
  • ffuf
  • nikto
  • Nmap
  • Hydra
  • Metasploit
  • John the Ripper
  • Linux & Windows privilege escalation

Network & Systems

  • Wireshark / PCAP
  • TCP/IP, IPv6, VLANs
  • Windows Server
  • Linux (Kali, Ubuntu)

0xmrerror@terminal:~$cat /var/log/experience.log

Experience — experience

Internships where I owned real systems, and the engineering degree they sit inside.

work

Keystone GroupJul 2026 – Sep 2026 · Tunis, TN
Security Engineering Intern — Malware Analysis
  • Architected an end-to-end 9-stage automated malware analysis pipeline in five phases: static triage with a .NET/native fork, live KVM/QEMU detonation with concurrent eBPF, VMI and network telemetry, then IOC extraction, threat-intel pivoting, weighted scoring, MinHash/LSH clustering and MITRE ATT&CK mapping into an automated PDF report.
  • Correlated host-side eBPF KVM tracepoints with Volatility3 VMI on a live guest, and patched KUSER_SHARED_DATA.TickCount in guest memory to defeat anti-sandbox timing checks. Validated against live AsyncRAT, AgentTesla and njRAT samples.
  • Deployed a multi-layer C2 sinkhole (iptables + DNSChef + INetSim) to capture malware traffic and extract actionable IOCs with false-positive filtering against Windows telemetry.
  • Automated threat attribution by matching IOCs against VirusTotal, AlienVault OTX and MalwareBazaar, grouping behavioural families with MinHash LSH clustering and generating PDF reports automatically.
Tunisie TelecomJun 2025 – Jul 2025 · Sfax, TN
Network Operations Intern
  • Triaged 15+ daily technical support tickets and provisioned network modems at scale, cutting average per-unit configuration time by 20% through scripted workflows.
  • Maintained network uptime across multiple customer sites.

education

ENIT — National School of Engineers of Tunis ICT Engineering — Telecommunications & Cybersecurity 2024 – Present
Cybersecurity specialization: malware analysis, network security, cryptography, secure systems design.
IPEIS — Preparatory Institute for Engineering Studies of Sfax Pre-Engineering — Mathematics & Physics 2022 – 2024
National entrance rank 440 / 1800 — top 24%.

beyond the keyboard

SECURINETS ENIT — cybersecurity clubG2FOSS — open-source software group

Arabic — nativeEnglish — C1French — B2German — A2

0xmrerror@terminal:~$ls -la ./projects 7 projects

Projects — projects

Security tooling, machine learning for binaries, and systems work. Each card links to what actually exists in public — where the repository is a write-up rather than code, it says so.

Architecture diagram of the 9-stage nested-VM malware analysis pipeline: static triage, live QEMU/KVM detonation with eBPF tracing, IOC extraction and scoring, clustering and ATT&CK attribution, PDF reporting.

Nested-VM Malware Analysis Pipeline

flagship

An end-to-end 9-stage automated malware analysis pipeline in five phases. QEMU/KVM live detonation with host-side eBPF syscall tracing correlated against Volatility3 VMI, anti-sandbox evasion via KUSER_SHARED_DATA patching in guest memory, multi-layer C2 sinkholing with DNSChef + INetSim + iptables, and automated MITRE ATT&CK attribution with MinHash LSH clustering. Validated against live AsyncRAT, AgentTesla and njRAT samples.

9 stages5 phaseseBPF + VMI3 malware families
PythonQEMU-KVMeBPFVolatility3+4: Speakeasy, de4dot, INetSim, DNSChef
GitHub source published
Diagram of the CFG function-localisation pipeline: binaries disassembled with Ghidra and angr into control-flow graphs, classified by GCN and GAT models.

CFG Function Localization via Graph Neural Networks

Stripped ELF/PE binaries disassembled with headless Ghidra and angr, then mapped into directed control-flow graphs whose node features are x86/ARM opcode distributions and API call references. GCNs and GATs (PyTorch Geometric) are trained for node-level classification of malicious functions — anti-debug loops, keyloggers and process-injection routines.

GCN / GATangr + Ghidranode classification
PythonPyTorch GeometricGhidraangr+2: GCN, GAT
GitHub write-up only — no source in the repo
Banner diagram of the RL-based intrusion detection system: a Double DQN agent choosing among six response actions in a Gymnasium environment.

RL-Based Intrusion Detection & Response

Network defense formulated as an MDP with six response actions (DPI, throttle, honeypot, block, isolate, quarantine) inside a custom Gymnasium environment. A Double DQN agent with prioritized experience replay is trained on CSE-CIC-IDS2018 telemetry to choose response actions instead of only raising alerts.

Double DQN + PER6 actionsCSE-CIC-IDS2018
PythonGymnasiumPyTorchCSE-CIC-IDS2018+1: Double DQN
GitHub write-up only — no source in the repo
Architecture diagram of the open-source SOC: Wazuh SIEM and Shuffle SOAR deployed with Ansible and Docker, with a Python suppression microservice filtering alert noise.

Open-Source SOC Automation

A Wazuh SIEM + Shuffle SOAR lab deployed automatically with Ansible and Docker. A Python suppression microservice filters 33,022 noisy events down to a single actionable incident — over 95% noise reduction — with a human-in-the-loop VirusTotal enrichment pipeline and custom detection rules validated against simulated brute force, lateral movement and privilege escalation.

33,022 → 1 incident>95% noise reductionAnsible + Docker
WazuhShuffle SOARMITRE ATT&CKPython+2: Docker, Ansible
GitHub source published
Screenshot of Village Under Attack, a real-time terminal strategy game in C++ with NPC pathfinding and collision detection.

Village Under Attack — C++ Strategy Game

A real-time terminal strategy game in C++ built on OOP principles, non-blocking I/O, NPC pathfinding and collision detection. Systems programming and algorithmic design outside a security context — the discipline that makes the reversing work easier.

Real-timeNon-blocking I/OPathfinding
C++OOPNon-blocking I/OPathfinding
GitHub source published

Wi-Fi Security Research

Demonstrated WPA2 and ARP-spoofing weaknesses with Wireshark and Bettercap in an isolated lab. Documented the MITM attack chain end to end and proposed concrete mitigations: 802.1X, HSTS enforcement and certificate pinning.

MITM chain802.1X / HSTS
WiresharkBettercapKali LinuxWPA2
lab work — nothing published

Embedded Face Recognition & Hardware Automation

A real-time facial recognition pipeline in Python/OpenCV driving an Arduino microcontroller over UART. Identity verification triggers a physical hardware action, demonstrating secure serial protocol design and embedded security.

Real-timeUARTOpenCV
PythonOpenCVArduinoEmbedded+1: UART
lab work — nothing published

the pipeline, end to end

Nine stages across five phases, and the module that runs each one. Hover a box for what it does.

phase 1Static analysis

Stage 1 Static triage static_triage.py
Stage 2 Deobfuscation deobfuscator.py
Stage 2b .NET unpacking stage2b_dotnet.py
Stage 3 CFG extraction cfg_extractor.py
Stage 4 Emulation speakeasy_emulator.py

phase 2Live detonation

Live window Live detonation QEMU / KVM

phase 3Extraction & scoring

Stage 5.1 Config decryption config_decryptor.py
Stage 5.2 IOC extraction ioc_extractor.py
Stage 5.3 Intel pivot threat_intel_pivot.py
Stage 5.4 Scoring scorer.py

phase 4Clustering & attribution

Stage 6 Clustering lsh_cluster.py
Stage 7 Master merge report skeleton
Stage 7.1 ATT&CK map attck_mapper.py
Stage 7.2 Campaign link campaign_correlator.py

phase 5Reporting & retention

Stage 8 PDF report report_generator.py
Stage 9 Retention policy

0xmrerror@terminal:~$ls -lt ./writeups | head -5 14 entries

writeups

The five hardest boxes I have written up, solved the way I actually solved them — the dead ends included. The rest are in the archive.

01. Easy as GDB — Scripted Character-by-Character Brute Force The flag is validated one character at a time, so automate it: script GDB to brute-force the key space inside a single session. Hard picoCTF Reverse engineering · 17 min 02. Keygenme — MD5 Hex Spliced Into a License Key The binary assembles the full 36-character key on the stack out of two MD5 digests — so the lazy solve is to break in and read it out. Hard picoCTF Reverse engineering · 18 min 03. JITFP — Reading a Flag That Only Exists in Live Memory The function-pointer table is empty on disk and filled at runtime by a ptrace service, so read RDX at the call instead of the table. Hard picoCTF Reverse engineering · 25 min 04. Mr Robot CTF — WordPress to Root A WordPress blog with a leaked wordlist, weak credentials and a hidden base64 login — a four-stage chain from recon to root. Medium TryHackMe Web · 20 min 05. WWBuddy — SQLi to Env-Var Privesc A half-built 'make friends' site with SQLi in the signup flow, and an environment-variable leak that turns a web foothold into sudo. Medium TryHackMe Web · 20 min

all 14 write-ups

0xmrerror@terminal:~$jq . ~/certs/verified.json 10 certifications

Certifications — certifications

Verified certifications across offensive security, SOC operations, DevSecOps, networking and machine learning.

0xmrerror@terminal:~$cat /etc/contact.conf

Contact — contact

Available for a 6-month internship from February 2027. If you are hiring for a security internship and this is the kind of work you want done, the email is the fastest route.

0xmrerror@terminal:~/contact
0xmrerror@terminal:~$ open /etc/contact.conf
email
phone
+216 28 654 038
github
skandarhadrich-cell
linkedin
skandar-hadrich
github linkedin

elsewhere

writeups all writeups →

cv CV → (also as PDF)

github skandarhadrich-cell

linkedin skandar-hadrich