I asked a clanker to make me a prompt that I can use to generate images of malware, like literal pictures that represent malware such as the ones used in samplepedia, not PE images. I got a warning for cyber abuse with threats to shut down my account o.O

I published an API tracer for kernel mode drivers using speakeasy emulation AI notice: It's vibe-coded. I manually analyzed ~20 drivers to verify and improve the output and tested with a corpus of ~100 drivers. github.com/struppigel/h...

New trainings sample on samplepedia Backdoor, obfuscated Python bytecode. 0/60 on Virustotal, which means it's still fresh. www.virustotal.com/gui/file/4ad... samplepedia.cc/sample/4ada6...

🦔 📹 Poison X kernel mode rootkit analysis ➡️ kernel mode driver theory ➡️ Ghidra markup ➡️ basic string deobfuscation #MalwareAnalysisForHedgehogs www.youtube.com/watch?v=yx6A...

I submitted a new sample to samplepedia.cc PoisonX rootkit. Video solution follows the next days. samplepedia.cc/sample/db5d2...

This seems to be a prevalent issue now: People vibe code security applications and the LLM generates real malware for testing. The generated test files rely on real threat actor infrastructure to download or exfiltrate. hxxps://github.com/DataDog/guarddog/blob/main/tests

😂 @rifteyy just pointed me to this gem in the VT comment section for the empty file www.virustotal.com/gui/file/e3b...

New Video: Build your own LLM dynamic analysis lab 🦔🎥 ➡️ AI debugs and unpacks with x64dbg ➡️ AI can access powershell terminal www.youtube.com/watch?v=QrWz...

My malware analysis courses have now a new certificate design. malwareanalysis-for-hedgehogs.learnworlds.com/courses

Added a task for the SugarSMP spark stealer sample to samplepedia samplepedia.cc/sample/060ed...

I wrote an article about SugarSMP Minecraft scams, Spark stealer, extortion and hacked accounts. After a brief contact to the threat actor, we talked to two victims and followed the trail. Analysis in collaboration with @rifteyy #GDATATechblog #GDATA blog.gdatasoftware.com/2026/03/3839...

🦔 📹 Video: Building your own AI Malware Analysis Lab ➡️ old system, 16 GB RAM ➡️ using Remnux #MalwareAnalysisForHedgehogs #LLM www.youtube.com/watch?v=YOdu...

🦔 📹 New video: NodeJs analysis when deobfuscator fails ➡️ #MythJs stealer sample ➡️ pkg VFS exploration tool ➡️ js-confuser #MalwareAnalysisForHedgehogs www.youtube.com/watch?v=gtLq...

New blog: Using LLMs the right way for malware analysis 💡Tips for building an autonomous AI analysis lab on a 12 yo laptop and getting stuff done faster without loss of accuracy. blog.gdatasoftware.com/2026/03/3838...

GuvercinInstaller.exe 1/72 #kurdishmyth stealer, NodeJS ➡️Infects discord_desktop_core\index.js ➡️Steals various browser and discord data. ➡️Exfiltrates via discord webhook. The code references kurdishmyth and mythprivate www.virustotal.com/gui/file/496...

We wrote about HijackLoader. Not exactly a new topic, but certainly an interesting journey. It provides some tools for HijackLoader too. blog.gdatasoftware.com/2026/02/3837...

samplepedia.cc update: You have now a new "My articles" overview (see profile dropdown menu), which allows you to add article drafts and manage articles. You can decide to publish such a draft as a solution later.

Found a nice trainings sample for analysis of kernel mode rootkits ↓ samplepedia.cc/sample/465dc...

Looks like the dev told an LLM to generate test files for a Shai Hulud detection app. The LLM complied and generated malicious test files... github.com/Cobenian/sha...

I created an extraction script for custom PyInstaller applications as seen in suspected EvilAI PDF apps. Script (modified pyinstxtractor-ng): github.com/struppigel/h... Article: samplepedia.cc/sample/8c9d9...

#Samplepedia updates * you can upload images for articles * view count for samples and articles * expert difficulty available samplepedia.cc

anyPDF malware analysis report rifteyy.org/report/anypd...

🦔 📹 New Video: Can office files be malicious without Macros? ➡️ VSTO Add-Ins ➡️ External Templates ➡️ Checklist for Office analysis #MalwareAnalysisForHedgehogs www.youtube.com/watch?v=RtHH...

If you like binary refinery, check out this sample It's also mostly undetected yet on VT: samplepedia.cc/sample/361f2...

@invokereversing.bsky.social is analyzing Floxif with binary ninja 👇 www.youtube.com/watch?v=2F_B...

Samplepedia update: Users can submit their own images with the samples and there is a platform field. samplepedia.cc

I have created a website, where you can share your sample analysis (via links or posts) and search samples for training based on tags and difficulty. If you write analysis blogs, you can share them there. samplepedia.cc

I added a python script to monitor a folder during dynamic analysis and dump changed files with timestamp github.com/struppigel/h...

🦔 📹New Video: RenPy game loads stealer, beginner friendly ➡️ strategies for finding malware in 2956 files ➡️ extracting and decompiling RenPy ➡️ remote access tool config extraction ➡️ unpacking native payload #MalwareAnalysisForHedgehogs #RenPy www.youtube.com/watch?v=Fmfg...

New blog: Browser Hijacking techniques -- when malware has different preferences than you www.gdatasoftware.com/blog/2025/11... #GDATA #GDATATechblog #BrowserHijacking

I added a RenPy archive (.rpa, .rpi) extractor to my tools repo github.com/struppigel/h...

My colleague Banu wrote about a new infostealer Arkanix www.gdatasoftware.com/blog/2025/12...

🦔📹 New Video: Modifying string decrypter for a ConfuserEx2 variant ➡️ Defeating antis with Harmony hooks ➡️ AsmResolver ➡️ .NET string deobfuscation #MalwareAnalysisForHedgehogs www.youtube.com/watch?v=sARn...

Black Friday offers: 60% off for 2 malware analysis courses (beginner & intermediate) Or 40% off for single course malwareanalysis-for-hedgehogs.learnworlds.com/courses

Lecture on Anti Tamper by Tim Blazytko www.youtube.com/watch?v=hQi9...

Rhadamanthys loader deobfuscation cyber.wtf/2025/11/19/r...

I am suggesting a new malware type: the browser remote access tool (BRAT) It's a form of browser hijacker that remotely controls your browser based on server commands. Typical form: press key combos for copy-pasting URLs, opening tabs, context menu, downloading files etc

For anyone who wants to understand certificates better and how to spot abuse, this is a great read certcentral.org/training

🦔 📹 Video: Analysis of malicious NordVPN setup ➡️ beginner-suitable ➡️ sorry, no spoilers here ;) www.youtube.com/watch?v=5-OY... #MalwareAnalysisForHedgehogs

I am looking for good resources for Linux malware analysis, including books and courses. If you have any recommendations please let me know.

My #VirusBulletin2025 loot 😍 I also met someone from vxunderground and all I got was this lousy sticker

Steam game BlockBlasters downloads malware written by Arvin Tan #GDATATechblog @GDATA #GDATA www.gdatasoftware.com/blog/2025/09...

My colleague Banu wrote about the connection between AppSuite, OneStart and ManualFinder www.gdatasoftware.com/blog/2025/09...

🦔 📹 New video: What breakpoints to set for unpacking malware? ➡️ Steps of unpacking stub ➡️ Breakpoint targets ➡️ VirtualAlloc from user to kernel mode #MalwareAnalysisForHedgehogs #Unpacking www.youtube.com/watch?v=fn8r...

In light of the new course, I created a Discord server for MalwareAnalysisForHedghogs to discuss malware analysis related topics. You can join here--this is for every malware enthusiast, not only course members: discord.gg/3evhC4cj

My intermediate level malware analysis course is there. 60% off for the next two weeks. malwareanalysis-for-hedgehogs.learnworlds.com/course/inter...

This blog post about impostor certificates by @SquiblydooBlog is a gem and very relevant right now. Or: How threat actors impersonate companies to obtain authenticode certificates for signing their malware. And why revokation is important. squiblydoo.blog/2024/05/13/i...

Our technical deep-dive about AppSuite PDF Editor backdoor is out 📝👇 www.gdatasoftware.com/blog/2025/08... #GDATA #GDATATechblog #AppSuite

IDA, why are you doing this? I lost my work because IDA refused to save. I needed to reboot the system to get network connection again. Without network there is no licensing server available. Surely there must be a better way to not loose work?

These PDF editors are functional but each contain a backdoor ➡️https://virustotal.com/gui/file/fde67ba523b2c1e517d679ad4eaf87925c6bbf2f171b9212462dc9a855faa34b bazaar.abuse.ch/sample/17355... URLs pdfreplace(dot)com pdfmeta(dot)com pdfartisan(dot)com appsuites(dot)ai #TamperedChef