Karsten Hahn
@struppigel
Followers
25K
Following
24K
Media
2K
Statuses
9K
MalwareAnalysisForHedgehogs, Principal Malware Researcher at GDATA, he/him 🦔🌈🏳️⚧️
International
Joined May 2014
My intermediate level malware analysis course is there. 60% off for the next two weeks. https://t.co/q16H43ihoF
malwareanalysis-for-hedgehogs.learnworlds.com
Signature writing, deobfuscation, dynamic API resolving, syscalls, hooking, shellcode analysis and more
11
49
219
New blog: Browser Hijacking techniques -- when malware has different preferences than you https://t.co/YABr0KuYgw
#GDATA @GDATA #GDATATechblog #BrowserHijacking
gdatasoftware.com
If you are searching for technical information on how browser hijacking works, there does not seem to be much out there apart from generic removal instructions. This might be an educational gap we...
0
4
21
CertCentral is now TheCertGraveyard[.]org & CertGraveyard[.]org. The CertCentral API returns an error directing to use the new domains. Please give me a like or a share to get the word out. Also use the site to report and investigate certificates used to sign malware. :)
I'm being required to give up the domain CertCentral[.]org; and the change has to happen by Monday. I'm noodling on alternative names. Keep an eye out for the change.
5
40
68
I added a RenPy archive (.rpa, .rpi) extractor to my tools repo https://t.co/cTUNlHTGZp
0
2
23
Last week, @SophosXOps reported a new packer/crypter called #Shanya (aka #ArmillariaLoader by @ciphertech). We hunted for this packer across our dataset and identified several early, previously unreported samples. The earliest sample observed in the wild dates back to December
1
9
36
Giveaways coming up: - @struppigel sponsoring malware analysis course giveaways for "Malware analysis for hedgehogs" (x10) - @nikhil_mitt sponsoring CRTE(x3) and CARTP(x3) - @HCAdamSec sponsoring 2024, 2025, DEFCON Aerospace village badge and RADIO SAO. These sold out at
78
26
383
https://t.co/amWPj0XJnP A look into the internals behind a large-scale proxy operation, from the sourcing of IPs to the platform itself. How proxy providers utilize everything from TV boxes to free software for building out a pool of unique proxies.
synthient.com
A look into the internals behind a large-scale proxy operation, from the sourcing of IPs to the platform itself. How proxy providers utilize everything from TV boxes to free software for building out...
6
21
140
My colleague Banu wrote about a new infostealer Arkanix https://t.co/UnRvyoQ60P
gdatasoftware.com
G DATA researcher Banu Ramakrishnan has discovered a previously undocumented infostealer malware called Arkanix. Learn about the details in the G DATA blog!
0
14
41
Final part of the first wave of RPC is live, RPC part8. In this part, I explain how to use IDA to reverse RPC clients and servers, and I show the key structures and methods you need to extract all the important information during the reversing process. https://t.co/lgaE52Uc9P
sud0ru.ghost.io
Welcome to the next part of the IPC series, and the final part of the first wave of RPC series. In this post, we will look at the tools you can use to reverse-engineer an RPC server. This part...
1
24
82
🦔📹 New Video: Modifying @vinopaljiri's string decrypter for a ConfuserEx2 variant ➡️ Defeating antis with Harmony hooks ➡️ AsmResolver ➡️ .NET string deobfuscation #MalwareAnalysisForHedgehogs
https://t.co/G1mOunwcEq
2
36
99
Black Friday offers: ➡️60% off for 2 malware analysis courses (beginner & intermediate) ➡️Or 40% off for single course https://t.co/jGZOa9nEUV
malwareanalysis-for-hedgehogs.learnworlds.com
2
20
86
CertCentral is now categorizing malware and adding analyst notes. If these are available, you'll see a button to expand the entry. 600/1700 entries have notes so far and the rest will be updated. Type is available in the CSV export. Both fields are returned by API lookups. 1/2
1
14
57
🚨NEW python stealer🚨 🛸Drops .pyd in %APPDATA%\Local\Temp\_MEIxxxxx ⚠️Relaunch itself via CreateProcessW Exfil👇 browser cookies and password Discord Steam 📡send data via telegram bot C2: api[.telegram[.org/bot8484778379:AAG_EhhM1Ao139HBPfgfV0zVlMSi-2HfkCM/sendMessage bazaar👇
2
8
22
Writeup of new PDF malware converter: https://t.co/XzSEinPcyt Persistence, remote code execution, browser hijack, obfuscation, and more. #YAPA #EvilAI @SquiblydooBlog @MalasadaTech808 @x3ph1 @SecurityAura
3
21
70
Awesome interview and showcase with Tim Blazytko about obfuscation and deobfuscation. https://t.co/HWvIvtbA9a
0
9
58
