@struppigel

MalwareAnalysisForHedgehogs, Principal Malware Researcher at GDATA, he/him 🦔🌈🏳️‍⚧️

 International
malwareanalysis-for-hedgehogs.learnworlds.com/
Joined May 2014
  • Tweets9.4K
  • Following783
  • Followers26K
1.6KMedia
My intermediate level malware analysis course is there. 60% off for the next two weeks. malwareanalysis-for-hedgehog…

Malware Analysis - Intermediate Level

Signature writing, deobfuscation, dynamic API resolving, syscalls, hooking, shellcode analysis and more

malwareanalysis-for-hedgehogs.com
12
49
3
221
31,727
New release of PortexAnalyzer GUI v1.0.0 is public X-ray your PE files Release download: github.com/struppigel/Portex… And a showcase video: youtube.com/watch?v=lhY0E9Mh…

Releases · struppigel/PortexAnalyzerGUI

Graphical interface for PortEx, a Portable Executable and Malware Analysis Library - struppigel/PortexAnalyzerGUI

github.com
10
38
3,528
Next version of PortexAnalyzerGUI will be able to zoom in and out of the PE visualization, and allow you to interactively browse structures. Will publish this weekend or so. (unlisted 1 min video without audio) youtube.com/watch?v=2UHSFVXJ…

Malware Analysis - PortexAnalyzerGUI newest version

Discord: https://discord.gg/8xB38EedHTCourses: https://www.malwar...

youtube.com
3
26
1,917
Karsten Hahn retweeted
Squiblydoo@SquiblydooBlogOct 9
Interesting malware signed “Guangzhou Guoying Communication Technology Co., Ltd.” and now revoked. Functional PDF editor with backdoor. My report has 3 C2, but have seen more: rogueauthority.org/quartzlin…
21
2
85
8,858
New PortEx release: ➡️ performance improvements for .NET files ➡️ support for interrupting analysis github.com/struppigel/PortEx…

Release Release 5.0.7 · struppigel/PortEx

PortEx 5.0.7 This release improves analysis responsiveness, and CLR parsing performance. Added support for interrupting analysis and improved CLI handling of cancellation and exit codes (PR #18). ...

github.com
1
7
13
2,952
"Hytale supply chain attack" Blog about Java malware by @m3mdump vithor.me/blog/hytale_supply…
6
1
29
1,596
That's not logically sound. It's still slop just with less em dashes.
4
954
IObit signature with lower case 'L' as in LObit. 🙄 virustotal.com/gui/file/3df9…
1
1
9
1,063
Same here virustotal.com/gui/file/092e…
2
291
New blog: OpenSUpdater Hides in Recompiled 7zip SFX #GDATATechblog @GDATA blog.gdatasoftware.com/2026/…
1
12
50
2,777
Someone pointed out to me that the full infection chain is outlined in this article from @_CPResearch_ (I am not sure it's the same malware, but it does sound like it) research.checkpoint.com/2026…

Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem - Check Point...

Research by: Alexey Bukhteyev Key Takeaways Introduction When we search Google for a popular piece of software, we usually click the first result, sometimes without even looking at the rest, because...

research.checkpoint.com
2
4
427
If you have purchased a ThinkNode M9 LoRA device from @Elecrow1/@ELECROW_JP, be aware the internally-mounted MicroSD card is infected: elecrow.com/Thinknode-M9-Sec…
1
1
5
737
Karsten Hahn retweeted
dark3v3@dark3v3Sep 18
Samplepedia writeup. This was another easy sample from @struppigel Check it out and let me know what you think. iluvblue.hashnode.dev/shortc…

Deep Dive into a Fileless .lnk Dropper

Analyze a malicious .lnk file acting as a fileless dropper. Discover how to analyze a lolbin abuse via windows shortcut.

iluvblue.hashnode.dev
2
1
369
BlueMoon exploit kit allows to infect systems if a user opens a link via Chrome or Chromium based browsers via v8 sandbox escape and RCE on Windows. proofpoint.com/us/blog/threa…

Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using...

Analyst note: Proofpoint uses the UNK_ designator to define clusters of activity that are still developing and have not been observed for long enough to receive a numerical TA designation.

proofpoint.com
1
1
10
1,238
Karsten Hahn retweeted
dark3v3@dark3v3Aug 26
My write up for one of the easy samples on Samplepedia @struppigel iluvblue.hashnode.dev/follow…

Excel OLE Malware: Hidden Streams Analysis

Analyze a suspicious Excel OLE document to uncover hidden payloads and decode creation timestamps from obfuscated URLs.

iluvblue.hashnode.dev
2
3
696
🦔 📹 New Video: Hooking V8 JavaScript ➡️ compiled V8 ➡️ we write a reusable hook script ➡️ we overcome basic anti-hooking #MalwareAnalysisForHedgehogs #V8 #JavaScript youtube.com/watch?v=Y8_AScwa…

Malware Analysis - Hooking V8 JavaScript bytecode

Compiled V8 JavaScript bytecode can be quickly analyzed with a reus...

youtube.com
1
11
53
8,297
Karsten Hahn retweeted
tmp.0ut@tmpoutAug 23
We are pleased to release tmp.0ut 5 Volume! Get your viruses, rootkits, strange ELFs, weird machines, tiny files, cool art, and phresh beats here!! tmpout.sh/5/
tmp.0ut 5 Table of Contents - ANSI art featuring a list of 21 papers

ALT tmp.0ut 5 Table of Contents - ANSI art featuring a list of 21 papers

21
327
23
1,183
85,112
Karsten Hahn retweeted
Kyle Cucci@d4rksystemAug 17
When RE’ing #malware with LLMs, have the LLM also write helper scripts (string/payload decrypters and config extractors) and run these manually on the malware binaries. These make it much easier to validate the LLM's RE quickly and can help expose hallucinations.
4
11
71
4,944
Blog: "Bad advice and myths around malware prevention" If you ever heard or said "visiting websites can't infect you", "PDFs aren't malicious" or "exploits are rare and always targeted" this article might be for you. blog.gdatasoftware.com/2026/… #GDATATechBlog #GDATA

Bad Advice and Myths Around Malware Prevention

Bad advice about malware prevention creates false confidence. Nuanced advice matters! Learn why websites, old exploits, and PDF files can still pose risks.

blog.gdatasoftware.com
12
35
2,586
New video: Compiled V8 JavaScript for reversers 🎥 ➡️ V8 compilation pipeline ➡️ bytecode caching ➡️ how bytenode abuses caching for protection youtube.com/watch?v=YSSCMSMc… #MalwareAnalysisForHedgehogs #JavaScript #V8

Theory Compiled JavaScript - V8 compilation pipeline and Bytenode

Some threat actors distribute JavaScript as compiled V8 bytecode to...

youtube.com
1
19
65
5,963
Do you remember the BlockBlasters Steam game that was used to steal from a man with cancer? FBI arrested the threat actor techspot.com/news/113163-fbi…

FBI arrests 21-year-old accused of infecting 8,000 PCs with malware through fake Steam games

The suspect, identified by the FBI as Zyaire Dontaevious Zamarion Wilkins, is accused of running a sophisticated cybercrime operation with unnamed co-conspirators for nearly two years. The...

techspot.com
1
6
11
1,803
Related article for BlockBlasters at the time: blog.gdatasoftware.com/2025/…

Infected Steam game downloads malware disguised as patch

A 2D platformer game called BlockBlasters has recently started showing signs of malicious activity after a patch release on August 30. While the user is playing the game, various bits of information...

blog.gdatasoftware.com
1
454
Load more