Looks like the dev told an LLM to generate test files for a Shai Hulud detection app. The LLM complied and generated malicious test files... github.com/Cobenian/sha...

I created an extraction script for custom PyInstaller applications as seen in suspected EvilAI PDF apps. Script (modified pyinstxtractor-ng): github.com/struppigel/h... Article: samplepedia.cc/sample/8c9d9...

#Samplepedia updates * you can upload images for articles * view count for samples and articles * expert difficulty available samplepedia.cc

anyPDF malware analysis report rifteyy.org/report/anypd...

🦔 📹 New Video: Can office files be malicious without Macros? ➡️ VSTO Add-Ins ➡️ External Templates ➡️ Checklist for Office analysis #MalwareAnalysisForHedgehogs www.youtube.com/watch?v=RtHH...

If you like binary refinery, check out this sample It's also mostly undetected yet on VT: samplepedia.cc/sample/361f2...

@invokereversing.bsky.social is analyzing Floxif with binary ninja 👇 www.youtube.com/watch?v=2F_B...

Samplepedia update: Users can submit their own images with the samples and there is a platform field. samplepedia.cc

I have created a website, where you can share your sample analysis (via links or posts) and search samples for training based on tags and difficulty. If you write analysis blogs, you can share them there. samplepedia.cc

I added a python script to monitor a folder during dynamic analysis and dump changed files with timestamp github.com/struppigel/h...

🦔 📹New Video: RenPy game loads stealer, beginner friendly ➡️ strategies for finding malware in 2956 files ➡️ extracting and decompiling RenPy ➡️ remote access tool config extraction ➡️ unpacking native payload #MalwareAnalysisForHedgehogs #RenPy www.youtube.com/watch?v=Fmfg...

New blog: Browser Hijacking techniques -- when malware has different preferences than you www.gdatasoftware.com/blog/2025/11... #GDATA #GDATATechblog #BrowserHijacking

I added a RenPy archive (.rpa, .rpi) extractor to my tools repo github.com/struppigel/h...

My colleague Banu wrote about a new infostealer Arkanix www.gdatasoftware.com/blog/2025/12...

🦔📹 New Video: Modifying string decrypter for a ConfuserEx2 variant ➡️ Defeating antis with Harmony hooks ➡️ AsmResolver ➡️ .NET string deobfuscation #MalwareAnalysisForHedgehogs www.youtube.com/watch?v=sARn...

Black Friday offers: 60% off for 2 malware analysis courses (beginner & intermediate) Or 40% off for single course malwareanalysis-for-hedgehogs.learnworlds.com/courses

Lecture on Anti Tamper by Tim Blazytko www.youtube.com/watch?v=hQi9...

Rhadamanthys loader deobfuscation cyber.wtf/2025/11/19/r...

I am suggesting a new malware type: the browser remote access tool (BRAT) It's a form of browser hijacker that remotely controls your browser based on server commands. Typical form: press key combos for copy-pasting URLs, opening tabs, context menu, downloading files etc

For anyone who wants to understand certificates better and how to spot abuse, this is a great read certcentral.org/training

🦔 📹 Video: Analysis of malicious NordVPN setup ➡️ beginner-suitable ➡️ sorry, no spoilers here ;) www.youtube.com/watch?v=5-OY... #MalwareAnalysisForHedgehogs

I am looking for good resources for Linux malware analysis, including books and courses. If you have any recommendations please let me know.

My #VirusBulletin2025 loot 😍 I also met someone from vxunderground and all I got was this lousy sticker

Steam game BlockBlasters downloads malware written by Arvin Tan #GDATATechblog @GDATA #GDATA www.gdatasoftware.com/blog/2025/09...

My colleague Banu wrote about the connection between AppSuite, OneStart and ManualFinder www.gdatasoftware.com/blog/2025/09...

🦔 📹 New video: What breakpoints to set for unpacking malware? ➡️ Steps of unpacking stub ➡️ Breakpoint targets ➡️ VirtualAlloc from user to kernel mode #MalwareAnalysisForHedgehogs #Unpacking www.youtube.com/watch?v=fn8r...

In light of the new course, I created a Discord server for MalwareAnalysisForHedghogs to discuss malware analysis related topics. You can join here--this is for every malware enthusiast, not only course members: discord.gg/3evhC4cj

My intermediate level malware analysis course is there. 60% off for the next two weeks. malwareanalysis-for-hedgehogs.learnworlds.com/course/inter...

This blog post about impostor certificates by @SquiblydooBlog is a gem and very relevant right now. Or: How threat actors impersonate companies to obtain authenticode certificates for signing their malware. And why revokation is important. squiblydoo.blog/2024/05/13/i...

Our technical deep-dive about AppSuite PDF Editor backdoor is out 📝👇 www.gdatasoftware.com/blog/2025/08... #GDATA #GDATATechblog #AppSuite

IDA, why are you doing this? I lost my work because IDA refused to save. I needed to reboot the system to get network connection again. Without network there is no licensing server available. Surely there must be a better way to not loose work?

These PDF editors are functional but each contain a backdoor ➡️https://virustotal.com/gui/file/fde67ba523b2c1e517d679ad4eaf87925c6bbf2f171b9212462dc9a855faa34b bazaar.abuse.ch/sample/17355... URLs pdfreplace(dot)com pdfmeta(dot)com pdfartisan(dot)com appsuites(dot)ai #TamperedChef

driver reversing 101 eversinc33.com/posts/driver...

Comprehensive analysis of #HijackLoader by Ryan Weil www.trellix.com/blogs/resear...

🔍New Blog: JustAskJacky -- AI brings back classical trojan horse malware www.gdatasoftware.com/blog/2025/08... #GDATA #GDATATechblog

🦔 📹 New Video: There is more than Clean and Malicious ➡️ 7 file analysis verdicts and what they mean #MalwareAnalysisForHedgehogs #Verdicts www.youtube.com/watch?v=XwT2...

Good news, the intermediate malware analysis course is almost finished. I have currently a test student working through the course to get rid of mistakes that I do not notice.

Nikola Knežević created an overview of AsyncRAT forks and how they relate to each other. Great research. #AsyncRAT #QuasarRAT www.welivesecurity.com/en/eset-rese...

Ghidra, scripting, LLM, automagic automation. That should grab the attention for this thread. If you want to read the complete blog, you can do so here: www.trellix.com/blogs/resear... 1/n

🦔 📹 Virut Part III: File infection analysis and bait file creation #MalwareAnalysisForHedgehogs #Virut www.youtube.com/watch?v=FcXP...

Blog: "Supper is served" Excellent analysis article of the backdoor Supper by @c-b.io c-b.io/2025-06-29+-...

Tips for newcomers to malware blog articles: ➡️You don't need to document every malware function. Focus on key areas ➡️Your text must be factually correct and it is okay to skip those details you are unsure about ➡️When you are done, just stop writing

A colleague and me wrote an article about EvilConwi -- signed ConnectWise remote access software being abused as malware #GDATATechblog www.gdatasoftware.com/blog/2025/06...

Virut part II: process infection and NTDLL hooking 🦔📹 ➡️x64dbg scripting ➡️conditional breakpoints ➡️more import table resolving ➡️fixing control flow ➡️marking up hook code #MalwareAnalysisForHedgehogs #Virut www.youtube.com/watch?v=nuxn...

Blog: Printer company provided infected printer software for half a year. ➡️ XRed backdoor ➡️ SnipVex virus Initially reported by Youtuber of "Serial Hobbyism" www.gdatasoftware.com/blog/2025/05...

🦔 📹New Video: Analysis of Virut - Part I ➡️ self-modifying code ➡️ Ghidra markup decryption stub ➡️ API resolving ➡️ unpacking #MalwareAnalysisForHedgehogs www.youtube.com/watch?v=250B...

I wrote how to use knowledge about .NET structures and streams for writing .NET Yara signatures. E.g. IL code patterns, method signature definitions, GUIDs, compressed length #GDATATechblog #100DaysOfYara www.gdatasoftware.com/blog/2025/04...

Podcast with @jstrosch.bsky.social and @psifertex.bsky.social about: binary ninja, CTFs, AI, the future of cyber security open.spotify.com/episode/6tMY...

🦔 📹 New Video: Unpacking Lumma Stealer We continue where we left off last time and unpack the Emmenhtal to Pure Crypter to Lumma Stealer chain. www.youtube.com/watch?v=aenO... #MalwareAnalysisForHedgehogs #LummaStealer

This curious wanna-be Batch virus appeared already on several systems. But why? autoexec.NT does not work anymore and it has an endless loop that pretends to scan. Did not find any tmp.bat yet. Not sure it even exists. www.virustotal.com/gui/file/e28...