Karsten Hahn

YouTube video by MalwareAnalysisForHedgehogs Malware Analysis - Trojanized NordVPN Setup, Beginner Sample

🦔 📹 Video: Analysis of malicious NordVPN setup
➡️ beginner-suitable
➡️ sorry, no spoilers here ;)

www.youtube.com/watch?v=5-OY...

#MalwareAnalysisForHedgehogs

I am looking for good resources for Linux malware analysis, including books and courses.
If you have any recommendations please let me know.

Thank you @threatresearch.bsky.social

My #VirusBulletin2025 loot 😍
I also met someone from vxunderground and all I got was this lousy sticker

Infected Steam game downloads malware disguised as patch A 2D platformer game called BlockBlasters has recently started showing signs of malicious activity after a patch release on August 30. While the user is playing the game, various bits of information a...

Steam game BlockBlasters downloads malware
written by Arvin Tan

#GDATATechblog @GDATA #GDATA
www.gdatasoftware.com/blog/2025/09...

AppSuite, OneStart & ManualFinder: The Nexus of Deception Having taken a look at AppSuite in one of our last articles, we have started pulling on a few loose threads to see where it would take us. It turns out that there are relationships with other maliciou...

My colleague Banu wrote about the connection between AppSuite, OneStart and ManualFinder

www.gdatasoftware.com/blog/2025/09...

Invite link for our Discord expired, because I did not change the default limit.
Here is a new one, this time without limit

discord.gg/8xB38EedHT

YouTube video by MalwareAnalysisForHedgehogs Malware Theory - What breakpoints to set for unpacking

🦔 📹 New video: What breakpoints to set for unpacking malware?
➡️ Steps of unpacking stub
➡️ Breakpoint targets
➡️ VirtualAlloc from user to kernel mode

#MalwareAnalysisForHedgehogs #Unpacking
www.youtube.com/watch?v=fn8r...

Thanks!

In light of the new course, I created a Discord server for MalwareAnalysisForHedghogs to discuss malware analysis related topics.

You can join here--this is for every malware enthusiast, not only course members: discord.gg/3evhC4cj

Malware Analysis - Intermediate Level Signature writing, deobfuscation, dynamic API resolving, syscalls, hooking, shellcode analysis and more

My intermediate level malware analysis course is there.
60% off for the next two weeks.

malwareanalysis-for-hedgehogs.learnworlds.com/course/inter...

Impostor Certificates It is common for malware to be signed with code signing certificates. How is this possible? Impostors receive the cert directly and sign malware. In this blog-post, we look at 100 certs used by Sol…

This blog post about impostor certificates by @SquiblydooBlog is a gem and very relevant right now.

Or: How threat actors impersonate companies to obtain authenticode certificates for signing their malware.
And why revokation is important.

squiblydoo.blog/2024/05/13/i...

Our technical deep-dive about AppSuite PDF Editor backdoor is out 📝👇

www.gdatasoftware.com/blog/2025/08...
#GDATA #GDATATechblog #AppSuite

IDA, why are you doing this?

I lost my work because IDA refused to save. I needed to reboot the system to get network connection again. Without network there is no licensing server available.
Surely there must be a better way to not loose work?

These PDF editors are functional but each contain a backdoor

➡️https://virustotal.com/gui/file/fde67ba523b2c1e517d679ad4eaf87925c6bbf2f171b9212462dc9a855faa34b
bazaar.abuse.ch/sample/17355...

URLs
pdfreplace(dot)com
pdfmeta(dot)com
pdfartisan(dot)com
appsuites(dot)ai

#TamperedChef

driver reversing 101
eversinc33.com/posts/driver...

Comprehensive analysis of #HijackLoader
by Ryan Weil

www.trellix.com/blogs/resear...

Thank you

JustAskJacky: AI brings back real trojan horse malware Despite what some might make you believe, late Trojan Horses were a rare breed in the malware zoo. But thanks to AI and LLMs, they are back..

🔍New Blog: JustAskJacky -- AI brings back classical trojan horse malware

www.gdatasoftware.com/blog/2025/08...

#GDATA #GDATATechblog

YouTube video by MalwareAnalysisForHedgehogs Analysis Verdicts: There is more than Clean and Malicious

🦔 📹 New Video: There is more than Clean and Malicious

➡️ 7 file analysis verdicts and what they mean

#MalwareAnalysisForHedgehogs #Verdicts
www.youtube.com/watch?v=XwT2...

The course will not be hosted on Udemy. I am very unhappy with it.

The Beginners' course will also be moved to the new platform.

Good news, the intermediate malware analysis course is almost finished.

I have currently a test student working through the course to get rid of mistakes that I do not notice.

Nikola Knežević created an overview of AsyncRAT forks and how they relate to each other. Great research.

#AsyncRAT #QuasarRAT
www.welivesecurity.com/en/eset-rese...

A side by side comparison of the original output by Ghidra, and the LLM enriched output.

Ghidra, scripting, LLM, automagic automation. That should grab the attention for this thread. If you want to read the complete blog, you can do so here: www.trellix.com/blogs/resear...
1/n

YouTube video by MalwareAnalysisForHedgehogs Malware Analysis - Virut's file infection, part 3

🦔 📹 Virut Part III: File infection analysis and bait file creation

#MalwareAnalysisForHedgehogs #Virut
www.youtube.com/watch?v=FcXP...

2025-06-29 - Supper is served - Humpty's RE Blog Recommend song to listen to while reading: If you find something off with what I say, please let me know. I'll gladly amend my content and credit you for the fix. Some thanks in alphabetical order

Blog: "Supper is served"
Excellent analysis article of the backdoor Supper by @c-b.io

c-b.io/2025-06-29+-...

Regarding the last point:

A conclusion makes sense if you have something to add that wasn't there before.

But if you just repeat what you wrote before, it is very boring. In those instances it is better to not add it at all. A blog is not a thesis.

Tips for newcomers to malware blog articles:

➡️You don't need to document every malware function. Focus on key areas
➡️Your text must be factually correct and it is okay to skip those details you are unsure about
➡️When you are done, just stop writing

Threat Actors abuse signed ConnectWise application as malware builder Since March 2025, there has been a noticeable increase in infections and fake applications using validly signed ConnectWise samples. We reveal how bad signing practices allow threat actors to abuse th...

A colleague and me wrote an article about EvilConwi -- signed ConnectWise remote access software being abused as malware
#GDATATechblog
www.gdatasoftware.com/blog/2025/06...

YouTube video by MalwareAnalysisForHedgehogs Malware Analysis - Virut's NTDLL Hooking and Process Infection, Part 2

Virut part II: process infection and NTDLL hooking 🦔📹
➡️x64dbg scripting
➡️conditional breakpoints
➡️more import table resolving
➡️fixing control flow
➡️marking up hook code

#MalwareAnalysisForHedgehogs #Virut
www.youtube.com/watch?v=nuxn...