@struppigel

MalwareAnalysisForHedgehogs, Principal Malware Researcher at GDATA, he/him 🦔🌈🏳️‍⚧️

 International
malwareanalysis-for-hedgehogs.learnworlds.com/
Joined May 2014
  • Tweets9.4K
  • Following783
  • Followers26K
1.6KMedia
Karsten Hahn retweeted
Squiblydoo@SquiblydooBlogOct 9
Interesting malware signed “Guangzhou Guoying Communication Technology Co., Ltd.” and now revoked. Functional PDF editor with backdoor. My report has 3 C2, but have seen more: rogueauthority.org/quartzlin…
21
2
80
7,283
If you have purchased a ThinkNode M9 LoRA device from @Elecrow1/@ELECROW_JP, be aware the internally-mounted MicroSD card is infected: elecrow.com/Thinknode-M9-Sec…
1
1
5
735
Karsten Hahn retweeted
dark3v3@dark3v3Sep 18
Samplepedia writeup. This was another easy sample from @struppigel Check it out and let me know what you think. iluvblue.hashnode.dev/shortc…

Deep Dive into a Fileless .lnk Dropper

Analyze a malicious .lnk file acting as a fileless dropper. Discover how to analyze a lolbin abuse via windows shortcut.

iluvblue.hashnode.dev
2
1
368
Karsten Hahn retweeted
dark3v3@dark3v3Aug 26
My write up for one of the easy samples on Samplepedia @struppigel iluvblue.hashnode.dev/follow…

Excel OLE Malware: Hidden Streams Analysis

Analyze a suspicious Excel OLE document to uncover hidden payloads and decode creation timestamps from obfuscated URLs.

iluvblue.hashnode.dev
2
3
696
Karsten Hahn retweeted
tmp.0ut@tmpoutAug 23
We are pleased to release tmp.0ut 5 Volume! Get your viruses, rootkits, strange ELFs, weird machines, tiny files, cool art, and phresh beats here!! tmpout.sh/5/
tmp.0ut 5 Table of Contents - ANSI art featuring a list of 21 papers

ALT tmp.0ut 5 Table of Contents - ANSI art featuring a list of 21 papers

21
328
23
1,185
84,985
Karsten Hahn retweeted
Kyle Cucci@d4rksystemAug 17
When RE’ing #malware with LLMs, have the LLM also write helper scripts (string/payload decrypters and config extractors) and run these manually on the malware binaries. These make it much easier to validate the LLM's RE quickly and can help expose hallucinations.
4
11
71
4,942
Karsten Hahn retweeted
Georgy Kucherin
@kucher1nMay 5
Together with @bzvr_, @2igosha and Anton Kargin, we identified that the DAEMON Tools software has been compromised in a complex supply chain attack since April 8. We see thousands of infections across 100+ countries. If you use DAEMON Tools, run a malware scan immediately! [1/7]
23
333
50
1,056
184,619
Karsten Hahn retweeted
rifteyy
@rifteyyApr 23
Malware delivery site https[:]//www-rarlab[.]com - WinRAR app.any.run/tasks/aabc0c21-3…
3
7
1
43
5,547
Karsten Hahn retweeted
Tim Blazytko
@mr_phrazerMar 26
The recording of my first Binary Cartography webinar is now public: Agentic Reverse Engineering: How AI Agents Are Changing Binary Analysis Topics: keygenning, cracking & anti-tamper removal Recording: youtube.com/watch?v=DZcDaXTv… Slides/code/samples: github.com/mrphrazer/binary-…
4
117
2
400
40,523
Karsten Hahn retweeted
Kostas
@KostastsaleMar 11
Today I’m launching Threat Hunting Labs. Over the years I’ve analyzed many real-world intrusions. One thing became obvious: most training platforms don’t resemble how investigations actually happen. So I built something different. Threat Hunting Labs focuses on investigation-driven learning using real telemetry and structured investigative paths. If you want to get better at investigating breaches, you should practice investigating breaches. More details here: threathuntinglabs.com/blog/i…

Introducing Threat Hunting Labs: Stop Finding Flags. Start Winning Breaches. | THL

Threat Hunting Labs is live with real intrusion telemetry, investigation-driven workflows, and practical SOC training across threat hunting, incident response, detection engineering, and malware...

threathuntinglabs.com
21
114
7
573
47,534
Karsten Hahn retweeted
vx-underground
@vxundergroundMar 18
I am genuinely impressed by mainstream media outlets ability to find absolute nobodies in cybersecurity. It's remarkable. I am often left speechless. There has been dozens occasions, especially as of recent, where some media outlet will be like, "Today as a special guest is world-renowned cybersecurity expert and ethical hacker Joe McCyberSecurity". I'm like, who the fuck is Joe McCybersecurity? I've been doing cybersecurity and malware stuff for a long time and I've never once seen or heard of Joe McCybersecurity. If he is world-renowned, I would THINK I would have seen them or heard of them. The camera then pans over to Joe McCybersecurity and it is the most generic cookie cutter white dude in a cheap suit and the tag below him will say something like, "Joe McCybersecurity, Ethical Hacker, CEO of Cybersecurity McJoe Industries" I'm like, "Cybersecurity McJoe Industries? What the fuck is that?". I look it up and it's a generic WordPress website hosted on GoDaddy with an expired SSL cert. Joe McCybersecurity then babbles incomprehensible nonsense for about 60 seconds until the TV host goes "woaw" and it cuts to a commercial. Absolute cinema.
108
137
14
2,239
91,519
Karsten Hahn retweeted
P4nd3m1cb0y
@P4nd3m1cb0yMar 16
🗞️ Hunting Malicious Mining Pools: Pivoting Through Crypto Mining Infrastructure This blog post aims to demonstrate how we can correlate a small cluster of IOCs to identify a malicious mining pool associated with the Tangerine Turkey operation. Check it out: theshadowslights.com/posts/t… CC: @johnk3r @_eremit4 @moval0x1 @akaclandestine @MichalKoczwara @1ZRR4H @struppigel

Hunting Malicious Mining Pools: Pivoting Through Crypto Mining Infrastructure

A blog about threat research

theshadowslights.com
25
73
9,447
Karsten Hahn retweeted
blackorbird
@blackorbirdMar 7
APT36 has pivoted from off-the-shelf malware to "vibeware", an AI-driven development model that produces a high-volume, mediocre mass of implants. Using niche languages like Nim, Zig, and Crystal, the actor seeks to evade standard detection engines while leveraging trusted cloud services, including Slack, Discord, Supabase, and Google Sheets, for command and control. #AISecurity bitdefender.com/en-us/blog/b…
9
95
15
387
101,827
Karsten Hahn retweeted
Duncan Ogilvie 🍍
@mrexodiaMar 3
Replying to @struppigel
FYI, x64dbg recommends x64.ooo/posts/2026-02-12-coo…

Cooking with x64dbg and MCP

Showcasing some really cool agentic skills built on x64dbg Automate and MCP. Decompilation, state-diffing, yara, deobfuscation, and more.

x64.ooo
2
17
128
4,427
Karsten Hahn retweeted
celeste
@vmfuncFeb 16
the watchers: how openai, the US government, and persona have been secretly running an identity surveillance system since nov 2023. vmfunc.re/blog/persona researched by @vmfunc, @MDLcsgo, @DziurwaF
124
827
144
4,190
500,027
Karsten Hahn retweeted
Squiblydoo@SquiblydooBlogFeb 19
Thanks to the proofpoint team for highlighting "TrustConnect Software PTY LTD". The actor got the cert hoping to look like a legitimate RMM—but in collaboration with Proofpoint—we didn't let them maintain the illusion. See Proofpoint's blog for all the details.
Tommy M (TheAnalyst)@ffforwardFeb 19
Would you run AdobeReader.exe from a days-old company called "TrustConnect Software PTY LTD" just because they managed to purchase an Extended Validation certificate? New blog out together with @proofpoint @threatinsight proofpoint.com/us/blog/threa…
2
12
27
5,482
Karsten Hahn retweeted
Who said what?
@g0njxaJan 11
Fake RVTools (#SmokedHam) pushed on malicious sponsored SEO, signed "Wuhan Shuoxi Technology Co., Ltd." (Certum issued) cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7 rvtoolspro[.]info rvtoolit[.]com download: app-cdn-software-gza4gebuf3cqd8h6.z03.azurefd[.]net/RVTools4.7.1-2?q=RVTools
3
7
1
45
5,647
Karsten Hahn retweeted
MalShare@mal_shareFeb 9
Today we have made the heavy decision to shutdown MalShare in response to losing our hosting provider. We do not have an ETA of when we will be back online.
13
32
2
114
34,102
Karsten Hahn retweeted
m4n0w4r@kienbigmummyJan 19
Thanks @struppigel for developing Samplepedia Platform. Here is my latest analysis as a contribution to this incredible repository. It is a privilege to give back to a community that consistently empowers malware researchers worldwide. kienmanowar.wordpress.com/20…

[Samplepedia Solution] Unveiling the Layers: Analyzing a Multi-Stage APT-Style Loader

I. Sample Information 5544e6c66cbf6503cddef2797acbff4fb81ededaef2334a596e6484cfaa0b8e8 II. Analysis Goal III. Executive Summary The malware is delivered as a 7z archive containing a legitimate exec…

kienmanowar.wordpress.com
5
18
2,304
Karsten Hahn retweeted
Squiblydoo@SquiblydooBlogJan 6
Uh, again? EmEditor download was replaced with a trojan signed "GRH PSYCHIC SERVICES LTD" Tried to download and execute powershell from emeditorltd[.]com https://app.any[.]run/tasks/6cfbe2bc-1771-4869-8ae2-a50d3ce362c0
Squiblydoo@SquiblydooBlog26 Dec 2025
Official EmEditor download had been replaced with a trojan signed "WALSHAM INVESTMENTS LIMITED" 👀 Browser extension persistence; DGA; steals a lot of different files and credentials. 🔗🧵 h/t @emilstahl
2
5
21
2,552
Load more