I added a python script to monitor a folder during dynamic analysis and dump changed files with timestamp github.com/struppigel/h...

🦔 📹New Video: RenPy game loads stealer, beginner friendly ➡️ strategies for finding malware in 2956 files ➡️ extracting and decompiling RenPy ➡️ remote access tool config extraction ➡️ unpacking native payload #MalwareAnalysisForHedgehogs #RenPy www.youtube.com/watch?v=Fmfg...

New blog: Browser Hijacking techniques -- when malware has different preferences than you www.gdatasoftware.com/blog/2025/11... #GDATA #GDATATechblog #BrowserHijacking

I added a RenPy archive (.rpa, .rpi) extractor to my tools repo github.com/struppigel/h...

My colleague Banu wrote about a new infostealer Arkanix www.gdatasoftware.com/blog/2025/12...

🦔📹 New Video: Modifying string decrypter for a ConfuserEx2 variant ➡️ Defeating antis with Harmony hooks ➡️ AsmResolver ➡️ .NET string deobfuscation #MalwareAnalysisForHedgehogs www.youtube.com/watch?v=sARn...

Black Friday offers: 60% off for 2 malware analysis courses (beginner & intermediate) Or 40% off for single course malwareanalysis-for-hedgehogs.learnworlds.com/courses

Lecture on Anti Tamper by Tim Blazytko www.youtube.com/watch?v=hQi9...

Rhadamanthys loader deobfuscation cyber.wtf/2025/11/19/r...

I am suggesting a new malware type: the browser remote access tool (BRAT) It's a form of browser hijacker that remotely controls your browser based on server commands. Typical form: press key combos for copy-pasting URLs, opening tabs, context menu, downloading files etc

For anyone who wants to understand certificates better and how to spot abuse, this is a great read certcentral.org/training

🦔 📹 Video: Analysis of malicious NordVPN setup ➡️ beginner-suitable ➡️ sorry, no spoilers here ;) www.youtube.com/watch?v=5-OY... #MalwareAnalysisForHedgehogs

I am looking for good resources for Linux malware analysis, including books and courses. If you have any recommendations please let me know.

My #VirusBulletin2025 loot 😍 I also met someone from vxunderground and all I got was this lousy sticker

Steam game BlockBlasters downloads malware written by Arvin Tan #GDATATechblog @GDATA #GDATA www.gdatasoftware.com/blog/2025/09...

My colleague Banu wrote about the connection between AppSuite, OneStart and ManualFinder www.gdatasoftware.com/blog/2025/09...

🦔 📹 New video: What breakpoints to set for unpacking malware? ➡️ Steps of unpacking stub ➡️ Breakpoint targets ➡️ VirtualAlloc from user to kernel mode #MalwareAnalysisForHedgehogs #Unpacking www.youtube.com/watch?v=fn8r...

In light of the new course, I created a Discord server for MalwareAnalysisForHedghogs to discuss malware analysis related topics. You can join here--this is for every malware enthusiast, not only course members: discord.gg/3evhC4cj

My intermediate level malware analysis course is there. 60% off for the next two weeks. malwareanalysis-for-hedgehogs.learnworlds.com/course/inter...

This blog post about impostor certificates by @SquiblydooBlog is a gem and very relevant right now. Or: How threat actors impersonate companies to obtain authenticode certificates for signing their malware. And why revokation is important. squiblydoo.blog/2024/05/13/i...

Our technical deep-dive about AppSuite PDF Editor backdoor is out 📝👇 www.gdatasoftware.com/blog/2025/08... #GDATA #GDATATechblog #AppSuite

IDA, why are you doing this? I lost my work because IDA refused to save. I needed to reboot the system to get network connection again. Without network there is no licensing server available. Surely there must be a better way to not loose work?

These PDF editors are functional but each contain a backdoor ➡️https://virustotal.com/gui/file/fde67ba523b2c1e517d679ad4eaf87925c6bbf2f171b9212462dc9a855faa34b bazaar.abuse.ch/sample/17355... URLs pdfreplace(dot)com pdfmeta(dot)com pdfartisan(dot)com appsuites(dot)ai #TamperedChef

driver reversing 101 eversinc33.com/posts/driver...

Comprehensive analysis of #HijackLoader by Ryan Weil www.trellix.com/blogs/resear...

🔍New Blog: JustAskJacky -- AI brings back classical trojan horse malware www.gdatasoftware.com/blog/2025/08... #GDATA #GDATATechblog

🦔 📹 New Video: There is more than Clean and Malicious ➡️ 7 file analysis verdicts and what they mean #MalwareAnalysisForHedgehogs #Verdicts www.youtube.com/watch?v=XwT2...

Good news, the intermediate malware analysis course is almost finished. I have currently a test student working through the course to get rid of mistakes that I do not notice.

Nikola Knežević created an overview of AsyncRAT forks and how they relate to each other. Great research. #AsyncRAT #QuasarRAT www.welivesecurity.com/en/eset-rese...

Ghidra, scripting, LLM, automagic automation. That should grab the attention for this thread. If you want to read the complete blog, you can do so here: www.trellix.com/blogs/resear... 1/n

🦔 📹 Virut Part III: File infection analysis and bait file creation #MalwareAnalysisForHedgehogs #Virut www.youtube.com/watch?v=FcXP...

Blog: "Supper is served" Excellent analysis article of the backdoor Supper by @c-b.io c-b.io/2025-06-29+-...

Tips for newcomers to malware blog articles: ➡️You don't need to document every malware function. Focus on key areas ➡️Your text must be factually correct and it is okay to skip those details you are unsure about ➡️When you are done, just stop writing

A colleague and me wrote an article about EvilConwi -- signed ConnectWise remote access software being abused as malware #GDATATechblog www.gdatasoftware.com/blog/2025/06...

Virut part II: process infection and NTDLL hooking 🦔📹 ➡️x64dbg scripting ➡️conditional breakpoints ➡️more import table resolving ➡️fixing control flow ➡️marking up hook code #MalwareAnalysisForHedgehogs #Virut www.youtube.com/watch?v=nuxn...

Blog: Printer company provided infected printer software for half a year. ➡️ XRed backdoor ➡️ SnipVex virus Initially reported by Youtuber of "Serial Hobbyism" www.gdatasoftware.com/blog/2025/05...

🦔 📹New Video: Analysis of Virut - Part I ➡️ self-modifying code ➡️ Ghidra markup decryption stub ➡️ API resolving ➡️ unpacking #MalwareAnalysisForHedgehogs www.youtube.com/watch?v=250B...

I wrote how to use knowledge about .NET structures and streams for writing .NET Yara signatures. E.g. IL code patterns, method signature definitions, GUIDs, compressed length #GDATATechblog #100DaysOfYara www.gdatasoftware.com/blog/2025/04...

Podcast with @jstrosch.bsky.social and @psifertex.bsky.social about: binary ninja, CTFs, AI, the future of cyber security open.spotify.com/episode/6tMY...

🦔 📹 New Video: Unpacking Lumma Stealer We continue where we left off last time and unpack the Emmenhtal to Pure Crypter to Lumma Stealer chain. www.youtube.com/watch?v=aenO... #MalwareAnalysisForHedgehogs #LummaStealer

This curious wanna-be Batch virus appeared already on several systems. But why? autoexec.NT does not work anymore and it has an endless loop that pretends to scan. Did not find any tmp.bat yet. Not sure it even exists. www.virustotal.com/gui/file/e28...

🦔 📹 New Video: Binary Refinery deobfuscation of a LummaStealer loader (PowerShell, JScript) www.youtube.com/watch?v=kHU_... #MalwareAnalysisForHedgehogs #PowerShell #JScript

We would have less fake news about malware on USB adapters and analysis time wasted if sandboxes changed their wording from "malicious" to "interesting to look at"--which is how they are actually understood by analysts. www.gdatasoftware.com/blog/2024/09...

🔍New Video: Antivirus myths 🔗 www.youtube.com/watch?v=4Dol... Or why these sentences are wrong: ➡️ AVs use mostly pattern signatures ➡️ AI is a new defense technique ➡️ defense techniques must focus on high detection rate ➡️ behavior signatures are heuristic and patterns are not

🦔 📹 Video: Learn how to write code based signatures ➡️ using privateloader as example ➡️ what to detect ➡️ where to set wildcards ➡️ how to test your rule on unpac me www.youtube.com/watch?v=oxC9... #MalwareAnalysisForHedgehogs #privateloader

Awesome stream with rattle/Jesko and Dr Josh Stroschein showcasing binary refinery Binref is hard to learn but very rewarding. www.youtube.com/live/-B072w0...

New video: Why antivirus software detects cracks as malware or PUP 🦔📹 #MalwareAnalysisForHedgehogs #cracks #antivirus www.youtube.com/watch?v=KA7R...

🦔 📹 New Video: D3fack loader analysis ➡️ Inno Setup pascal script analysis ➡️ string deobfuscation with binary refinery ➡️ JPHP decompilation Sample was first described by @RussianPanda9xx www.youtube.com/watch?v=y09Z... #MalwareAnalysisForHedgehogs #D3fackLoader

New Video: Why malware simulators cannot tell you if a malware or technique is detected by AV🦔📹 (... unless they were specifically made for that product) #MalwareAnalysisForHedgehogs www.youtube.com/watch?v=yJZC...

🦔 📹 Triaging 9 Samples on VirusTotal ➡️ Why does Bitdefender dominate the detection rate? ➡️ Why do launchers look so suspicious? ➡️ Why does well-known shellcode have a low detection rate? #MalwareAnalysisForHedgehogs #VirusTotal www.youtube.com/watch?v=v8fR...