Malware Reverse Engineer. Instructor & Author. Occasional YouTuber.

Washington, DC
Joined November 2007
Code analysis is intimidating. It's tedious and hard to know where to start and when to stop. In this video, I walk through an approach that makes it more digestible, and hopefully more fun. We use it on ransomware that...connects to printers? Join me for this one: youtu.be/fHXv3bdXLqk
2
5
17,435
Anuj Soni retweeted
If you work in #securityengineering or #threathunting, my tip this week is: Don’t sleep on browser extensions or IDE extensions — they’re a stealthy threat 👇 1. Backdoored Browser Extensions: arstechnica.com/security/202… 2. Malicious VSCode Extensions: mdsec.co.uk/2023/08/leveragi…
6
25
2
165
19,116
I trust AI to plan vacations, but analyzing malware and producing a final report? Not so much. If you’re looking for a way to start using AI to support parts of your workflow, watch this: youtu.be/4ok4e0Jvy_4
🤖 Made with AI
1
4
11
962
Anuj Soni retweeted
#BSidesCharm 2026 training spotlight today: Anuj Soni (@asoni) presenting the Sat morning training session "Malware Analysis Fundamentals: A Hands-On Workshop"
3
4
352
Anuj Soni retweeted
One issue with all this LLM reverse engineering hype is a misunderstanding what RE means. True RE delivers a complete understanding of malware and all its capabilities. Most of these LLM demos I’ve seen are just replicating what malware sandboxes have been doing for a decade.
7
15
3
116
10,601
Modern Windows malware is often obfuscated, and if automation falls short, a debugger could be the fastest way to uncover the underlying code. In my latest video, I use @x64dbg to deobfuscate and dump the payload of a multi-stage Windows malware sample. youtu.be/-lYiKq0t5sc
2
4
16
1,232
Want to learn Windows malware analysis but not sure where to start? I organized my beginner videos into the ideal sequence: 1⃣ mindset/approach 2⃣ lab 3⃣ static analysis 4⃣ behavior analysis Every video has links to tools and samples so you can follow along. youtube.com/playlist?list=PL…
1
4
718
Part 3 of my Malicious Shellcode Analysis series is live! 🔥 We kick off static analysis: pull strings, uncover hidden data, and use rule matching to ID malware families. New update to my malware analysis template too. 🎥 Watch: youtu.be/jQFKOXC_MaU
1
15
79
4,558
Grateful for the spotlight - thank you @DfirDiva!
Today's Training Tuesday Highlight is @asoni! Want to learn Malware Analysis & Reverse Engineering? Check out his awesome FREE videos with links to the samples included in the descriptions so you can follow along! YouTube Channel: youtube.com/@sonianuj #MalwareAnalysis #IncidentResponse #DFIRDivaTTH
1
1
22
2,131
Part 2 of my shellcode analysis series is here! This time, we’re automating shellcode extraction with one of @hasherezade’s incredible open-source tools. 🎥 Watch now: youtu.be/D6Bm5vD78eY
4
30
2
129
15,560
Launching a series on malicious shellcode analysis! In Part 1, I share an approach to manually extract shellcode from multi-stage malware, with help from @x64dbg and @vector35's Binary Ninja. 👉 Watch now: youtu.be/642VUEjMeLw Part 2 will explore automating shellcode extraction (coming soon—subscribe so you don't miss it!).
3
45
150
8,391
One of my favorite videos from @_JohnHammond, love the deep dive into a hashing algorithm with Binja and the step-by-step approach to implementing it in Python🔥
Supply chain malware from an infected game mod 🤯😱 Long-form reverse engineering and a WILD ride: Binary Ninja, x64dbg, 010 Editor, PEB walking, reworking API function hashing in Python, DLL search-order hijacking, hooked functions & more. MASSIVE video: jh.live/bvyklJ5Wie0
2
3
35
10,824
Super excited to dive into @vector35 training this week!
1
1
29
1,614
After far too long, I signed up to sponsor @x64dbg! If you benefit from x64dbg like I do, consider supporting this essential tool: github.com/sponsors/mrexodia…. And if x64dbg isn’t in your toolkit, think about supporting the tools that are. Free tools may be 'free', but they’re costly in time and effort for the developers. Let’s support them so they can keep supporting us!
4
1
18
4,960
🚨 @UHC is hiring a Senior Malware Analyst! 🚨 If analyzing malware is your mission, apply now: careers.unitedhealthgroup.co… This is a remote role, but candidates must be located in the U.S. Not for you? Please retweet – this might be the opportunity one of your followers has been waiting for.
5
5
1,481
🤩 I’m honored to announce that I’ve been nominated for the @SANSInstitute Difference Maker award in the category "Practitioner of the Year"! 🎉 If you’ve liked my work, you can cast your vote here 👇Thanks a lot for your support! 🙏 ❤️ #infosec survey.sans.org/jfe/form/SV_…
15
15
4
114
9,953
capa v7.3 out! Recently we’ve added: - Drakvuf and @vmray sandbox support - web interfaces for results, rules, and homepage - BinExport2 backend that enables aarch64 and Android analysis via Ghidra - …and of course lots of new rules github.com/mandiant/capa/rel…
1
37
1
108
9,929