@struppigel

MalwareAnalysisForHedgehogs, Principal Malware Researcher at GDATA, he/him 🦔🌈🏳️‍⚧️

 International
malwareanalysis-for-hedgehogs.learnworlds.com/
Joined May 2014
  • Tweets9.4K
  • Following783
  • Followers26K
1.6KMedia
My intermediate level malware analysis course is there. 60% off for the next two weeks. malwareanalysis-for-hedgehog…

Malware Analysis - Intermediate Level

Signature writing, deobfuscation, dynamic API resolving, syscalls, hooking, shellcode analysis and more

malwareanalysis-for-hedgehogs.com
12
49
3
221
31,670
New release of PortexAnalyzer GUI v1.0.0 is public X-ray your PE files Release download: github.com/struppigel/Portex… And a showcase video: youtube.com/watch?v=lhY0E9Mh…

Releases · struppigel/PortexAnalyzerGUI

Graphical interface for PortEx, a Portable Executable and Malware Analysis Library - struppigel/PortexAnalyzerGUI

github.com
10
37
3,207
Next version of PortexAnalyzerGUI will be able to zoom in and out of the PE visualization, and allow you to interactively browse structures. Will publish this weekend or so. (unlisted 1 min video without audio) youtube.com/watch?v=2UHSFVXJ…

Malware Analysis - PortexAnalyzerGUI newest version

Discord: https://discord.gg/8xB38EedHTCourses: https://www.malwar...

youtube.com
3
26
1,883
Karsten Hahn retweeted
Squiblydoo
@SquiblydooBlogOct 9
Interesting malware signed “Guangzhou Guoying Communication Technology Co., Ltd.” and now revoked. Functional PDF editor with backdoor. My report has 3 C2, but have seen more: rogueauthority.org/quartzlin…
21
2
80
7,274
New PortEx release: ➡️ performance improvements for .NET files ➡️ support for interrupting analysis github.com/struppigel/PortEx…

Release Release 5.0.7 · struppigel/PortEx

PortEx 5.0.7 This release improves analysis responsiveness, and CLR parsing performance. Added support for interrupting analysis and improved CLI handling of cancellation and exit codes (PR #18). ...

github.com
1
7
13
2,929
"Hytale supply chain attack" Blog about Java malware by @m3mdump vithor.me/blog/hytale_supply…
6
1
29
1,583
That's not logically sound. It's still slop just with less em dashes.
4
946
IObit signature with lower case 'L' as in LObit. 🙄 virustotal.com/gui/file/3df9…
1
1
9
1,057
Same here virustotal.com/gui/file/092e…
2
286
New blog: OpenSUpdater Hides in Recompiled 7zip SFX #GDATATechblog @GDATA blog.gdatasoftware.com/2026/…
1
12
50
2,772
Someone pointed out to me that the full infection chain is outlined in this article from @_CPResearch_ (I am not sure it's the same malware, but it does sound like it) research.checkpoint.com/2026…

Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem - Check Point...

Research by: Alexey Bukhteyev Key Takeaways Introduction When we search Google for a popular piece of software, we usually click the first result, sometimes without even looking at the rest, because...

research.checkpoint.com
2
4
424
If you have purchased a ThinkNode M9 LoRA device from @Elecrow1/@ELECROW_JP, be aware the internally-mounted MicroSD card is infected: elecrow.com/Thinknode-M9-Sec…
1
1
5
735
Karsten Hahn retweeted
dark3v3@dark3v3Sep 18
Samplepedia writeup. This was another easy sample from @struppigel Check it out and let me know what you think. iluvblue.hashnode.dev/shortc…

Deep Dive into a Fileless .lnk Dropper

Analyze a malicious .lnk file acting as a fileless dropper. Discover how to analyze a lolbin abuse via windows shortcut.

iluvblue.hashnode.dev
2
1
368
BlueMoon exploit kit allows to infect systems if a user opens a link via Chrome or Chromium based browsers via v8 sandbox escape and RCE on Windows. proofpoint.com/us/blog/threa…

Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using...

Analyst note: Proofpoint uses the UNK_ designator to define clusters of activity that are still developing and have not been observed for long enough to receive a numerical TA designation.

proofpoint.com
1
1
10
1,234
Karsten Hahn retweeted
dark3v3@dark3v3Aug 26
My write up for one of the easy samples on Samplepedia @struppigel iluvblue.hashnode.dev/follow…

Excel OLE Malware: Hidden Streams Analysis

Analyze a suspicious Excel OLE document to uncover hidden payloads and decode creation timestamps from obfuscated URLs.

iluvblue.hashnode.dev
2
3
696
🦔 📹 New Video: Hooking V8 JavaScript ➡️ compiled V8 ➡️ we write a reusable hook script ➡️ we overcome basic anti-hooking #MalwareAnalysisForHedgehogs #V8 #JavaScript youtube.com/watch?v=Y8_AScwa…

Malware Analysis - Hooking V8 JavaScript bytecode

Compiled V8 JavaScript bytecode can be quickly analyzed with a reus...

youtube.com
1
11
53
8,291
Karsten Hahn retweeted
tmp.0ut@tmpoutAug 23
We are pleased to release tmp.0ut 5 Volume! Get your viruses, rootkits, strange ELFs, weird machines, tiny files, cool art, and phresh beats here!! tmpout.sh/5/
tmp.0ut 5 Table of Contents - ANSI art featuring a list of 21 papers

ALT tmp.0ut 5 Table of Contents - ANSI art featuring a list of 21 papers

21
328
23
1,185
84,984
Karsten Hahn retweeted
Kyle Cucci@d4rksystemAug 17
When RE’ing #malware with LLMs, have the LLM also write helper scripts (string/payload decrypters and config extractors) and run these manually on the malware binaries. These make it much easier to validate the LLM's RE quickly and can help expose hallucinations.
4
11
71
4,942
Blog: "Bad advice and myths around malware prevention" If you ever heard or said "visiting websites can't infect you", "PDFs aren't malicious" or "exploits are rare and always targeted" this article might be for you. blog.gdatasoftware.com/2026/… #GDATATechBlog #GDATA

Bad Advice and Myths Around Malware Prevention

Bad advice about malware prevention creates false confidence. Nuanced advice matters! Learn why websites, old exploits, and PDF files can still pose risks.

blog.gdatasoftware.com
12
35
2,584
New video: Compiled V8 JavaScript for reversers 🎥 ➡️ V8 compilation pipeline ➡️ bytecode caching ➡️ how bytenode abuses caching for protection youtube.com/watch?v=YSSCMSMc… #MalwareAnalysisForHedgehogs #JavaScript #V8

Theory Compiled JavaScript - V8 compilation pipeline and Bytenode

Some threat actors distribute JavaScript as compiled V8 bytecode to...

youtube.com
1
19
65
5,962
Do you remember the BlockBlasters Steam game that was used to steal from a man with cancer? FBI arrested the threat actor techspot.com/news/113163-fbi…

FBI arrests 21-year-old accused of infecting 8,000 PCs with malware through fake Steam games

The suspect, identified by the FBI as Zyaire Dontaevious Zamarion Wilkins, is accused of running a sophisticated cybercrime operation with unnamed co-conspirators for nearly two years. The...

techspot.com
1
6
11
1,782
Related article for BlockBlasters at the time: blog.gdatasoftware.com/2025/…

Infected Steam game downloads malware disguised as patch

A 2D platformer game called BlockBlasters has recently started showing signs of malicious activity after a patch release on August 30. While the user is playing the game, various bits of information...

blog.gdatasoftware.com
1
453
Load more