Karsten Hahn

YouTube video by MalwareAnalysisForHedgehogs Analysis Verdicts: There is more than Clean and Malicious

🦔 📹 New Video: There is more than Clean and Malicious

➡️ 7 file analysis verdicts and what they mean

#MalwareAnalysisForHedgehogs #Verdicts
www.youtube.com/watch?v=XwT2...

The course will not be hosted on Udemy. I am very unhappy with it.

The Beginners' course will also be moved to the new platform.

Good news, the intermediate malware analysis course is almost finished.

I have currently a test student working through the course to get rid of mistakes that I do not notice.

Nikola Knežević created an overview of AsyncRAT forks and how they relate to each other. Great research.

#AsyncRAT #QuasarRAT
www.welivesecurity.com/en/eset-rese...

A side by side comparison of the original output by Ghidra, and the LLM enriched output.

Ghidra, scripting, LLM, automagic automation. That should grab the attention for this thread. If you want to read the complete blog, you can do so here: www.trellix.com/blogs/resear...
1/n

YouTube video by MalwareAnalysisForHedgehogs Malware Analysis - Virut's file infection, part 3

🦔 📹 Virut Part III: File infection analysis and bait file creation

#MalwareAnalysisForHedgehogs #Virut
www.youtube.com/watch?v=FcXP...

2025-06-29 - Supper is served - Humpty's RE Blog Recommend song to listen to while reading: If you find something off with what I say, please let me know. I'll gladly amend my content and credit you for the fix. Some thanks in alphabetical order

Blog: "Supper is served"
Excellent analysis article of the backdoor Supper by @c-b.io

c-b.io/2025-06-29+-...

Regarding the last point:

A conclusion makes sense if you have something to add that wasn't there before.

But if you just repeat what you wrote before, it is very boring. In those instances it is better to not add it at all. A blog is not a thesis.

Tips for newcomers to malware blog articles:

➡️You don't need to document every malware function. Focus on key areas
➡️Your text must be factually correct and it is okay to skip those details you are unsure about
➡️When you are done, just stop writing

Threat Actors abuse signed ConnectWise application as malware builder Since March 2025, there has been a noticeable increase in infections and fake applications using validly signed ConnectWise samples. We reveal how bad signing practices allow threat actors to abuse th...

A colleague and me wrote an article about EvilConwi -- signed ConnectWise remote access software being abused as malware
#GDATATechblog
www.gdatasoftware.com/blog/2025/06...

YouTube video by MalwareAnalysisForHedgehogs Malware Analysis - Virut's NTDLL Hooking and Process Infection, Part 2

Virut part II: process infection and NTDLL hooking 🦔📹
➡️x64dbg scripting
➡️conditional breakpoints
➡️more import table resolving
➡️fixing control flow
➡️marking up hook code

#MalwareAnalysisForHedgehogs #Virut
www.youtube.com/watch?v=nuxn...

Procolored: Printer company serves malware für six months, claims "false positive" warnings What do a coin stealer, an abandoned backdoor and a file infector have in common? They all resided in the download section on the website of a printer company - stowed away in installer files for driv...

Blog: Printer company provided infected printer software for half a year.

➡️ XRed backdoor
➡️ SnipVex virus

Initially reported by Youtuber of "Serial Hobbyism"

www.gdatasoftware.com/blog/2025/05...

YouTube video by MalwareAnalysisForHedgehogs Malware Analysis - Virut, a polymorphic file infector

🦔 📹New Video: Analysis of Virut - Part I
➡️ self-modifying code
➡️ Ghidra markup decryption stub
➡️ API resolving
➡️ unpacking
#MalwareAnalysisForHedgehogs
www.youtube.com/watch?v=250B...

100 Days of YARA: How to write .NET code signatures If you write YARA signatures for .NET assemblies only relying on strings, you are seriously missing out. Learn what you can do to level up your YARA rules.

I wrote how to use knowledge about .NET structures and streams for writing .NET Yara signatures.

E.g. IL code patterns, method signature definitions, GUIDs, compressed length

#GDATATechblog #100DaysOfYara
www.gdatasoftware.com/blog/2025/04...

EP07 Jordan Wiens - Inside the Mind of a Binary Ninja: CTFs, AI and the Future of Cyber Security Behind the Binary by Google Cloud Security · Episode

Podcast with @jstrosch.bsky.social and @psifertex.bsky.social about:
binary ninja, CTFs, AI, the future of cyber security

open.spotify.com/episode/6tMY...

This might also be interesting for you if you want to know how to deobfuscate .NET Reactor 6 or how to debug .NET DLL files.

Maybe it was created with AI help but the creator did not understand that it does not work. Dunno, my guess is as good as yours.

YouTube video by MalwareAnalysisForHedgehogs Malware Analysis - Unpacking Lumma Stealer from Emmenhtal and Pure Crypter

🦔 📹 New Video: Unpacking Lumma Stealer

We continue where we left off last time and unpack the Emmenhtal to Pure Crypter to Lumma Stealer chain.

www.youtube.com/watch?v=aenO...

#MalwareAnalysisForHedgehogs #LummaStealer

This curious wanna-be Batch virus appeared already on several systems. But why?

autoexec.NT does not work anymore and it has an endless loop that pretends to scan.

Did not find any tmp.bat yet. Not sure it even exists.

www.virustotal.com/gui/file/e28...

YouTube video by MalwareAnalysisForHedgehogs Malware Analysis - Binary Refinery URL extraction of Multi-Layered PoshLoader for LummaStealer

🦔 📹 New Video: Binary Refinery deobfuscation of a LummaStealer loader (PowerShell, JScript)

www.youtube.com/watch?v=kHU_...
#MalwareAnalysisForHedgehogs #PowerShell #JScript

Sandbox scores are not an antivirus replacement Automatic sandbox services should not be treated like "antivirus scanners" to determine maliciousness for samples. That’s not their intended use, and they perform poorly in that role. Unfortunately, p...

We would have less fake news about malware on USB adapters and analysis time wasted if sandboxes changed their wording from "malicious" to "interesting to look at"--which is how they are actually understood by analysts.

www.gdatasoftware.com/blog/2024/09...

Thanks!

What is the name of the book?

Thank you :)

YouTube video by MalwareAnalysisForHedgehogs Antivirus myths and how AVs actually work

🔍New Video: Antivirus myths
🔗 www.youtube.com/watch?v=4Dol...

Or why these sentences are wrong:
➡️ AVs use mostly pattern signatures
➡️ AI is a new defense technique
➡️ defense techniques must focus on high detection rate
➡️ behavior signatures are heuristic and patterns are not

Thank you. This was not written by me but my colleague Marius Benthin :)

Start at minute 36:07 to get the summary of tips.

Sample is available here: www.unpac.me/results/3c11...

PrivateLoader Yara rule: gist.github.com/struppigel/c...

YouTube video by MalwareAnalysisForHedgehogs Malware Analysis - Writing Code Signatures

🦔 📹 Video: Learn how to write code based signatures
➡️ using privateloader as example
➡️ what to detect
➡️ where to set wildcards
➡️ how to test your rule on unpac me
www.youtube.com/watch?v=oxC9...
#MalwareAnalysisForHedgehogs #privateloader

Awesome stream with rattle/Jesko and Dr Josh Stroschein
showcasing binary refinery

Binref is hard to learn but very rewarding.

www.youtube.com/live/-B072w0...

Hey thanks!