Karsten Hahn@struppigel

MalwareAnalysisForHedgehogs, Principal Malware Researcher at GDATA, he/him 🦔🌈🏳️‍⚧️

 International
malwareanalysis-for-hedgehog…
Joined May 2014
1,607 Photos and videos
My intermediate level malware analysis course is there. 60% off for the next two weeks. malwareanalysis-for-hedgehog…

Malware Analysis - Intermediate Level

Signature writing, deobfuscation, dynamic API resolving, syscalls, hooking, shellcode analysis and more

malwareanalysis-for-hedgehogs.com
12
49
221
31,467
New blog: OpenSUpdater Hides in Recompiled 7zip SFX #GDATATechblog @GDATA blog.gdatasoftware.com/2026/…
1
12
50
2,511
Someone pointed out to me that the full infection chain is outlined in this article from @_CPResearch_ (I am not sure it's the same malware, but it does sound like it) research.checkpoint.com/2026…

Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem - Check Point...

Research by: Alexey Bukhteyev Key Takeaways Introduction When we search Google for a popular piece of software, we usually click the first result, sometimes without even looking at the rest, because...

research.checkpoint.com
2
4
339
If you have purchased a ThinkNode M9 LoRA device from @Elecrow1/@ELECROW_JP, be aware the internally-mounted MicroSD card is infected: elecrow.com/Thinknode-M9-Sec…
1
1
5
670
Karsten Hahn retweeted
dark3v3@dark3v3
Sep 18
Samplepedia writeup. This was another easy sample from @struppigel Check it out and let me know what you think. iluvblue.hashnode.dev/shortc…

Deep Dive into a Fileless .lnk Dropper

Analyze a malicious .lnk file acting as a fileless dropper. Discover how to analyze a lolbin abuse via windows shortcut.

iluvblue.hashnode.dev
2
1
361
BlueMoon exploit kit allows to infect systems if a user opens a link via Chrome or Chromium based browsers via v8 sandbox escape and RCE on Windows. proofpoint.com/us/blog/threa…

Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using...

Analyst note: Proofpoint uses the UNK_ designator to define clusters of activity that are still developing and have not been observed for long enough to receive a numerical TA designation.

proofpoint.com
1
10
1,182
Karsten Hahn retweeted
dark3v3@dark3v3
Aug 26
My write up for one of the easy samples on Samplepedia @struppigel iluvblue.hashnode.dev/follow…

Excel OLE Malware: Hidden Streams Analysis

Analyze a suspicious Excel OLE document to uncover hidden payloads and decode creation timestamps from obfuscated URLs.

iluvblue.hashnode.dev
2
3
694
🦔 📹 New Video: Hooking V8 JavaScript ➡️ compiled V8 ➡️ we write a reusable hook script ➡️ we overcome basic anti-hooking #MalwareAnalysisForHedgehogs #V8 #JavaScript piped.video/watch?v=Y8_AScwa…

Malware Analysis - Hooking V8 JavaScript bytecode

Compiled V8 JavaScript bytecode can be quickly analyzed with a reus...

youtube.com
1
11
53
8,226
Karsten Hahn retweeted
tmp.0ut@tmpout
Aug 23
We are pleased to release tmp.0ut 5 Volume! Get your viruses, rootkits, strange ELFs, weird machines, tiny files, cool art, and phresh beats here!! tmpout.sh/5/
tmp.0ut 5 Table of Contents - ANSI art featuring a list of 21 papers

ALT tmp.0ut 5 Table of Contents - ANSI art featuring a list of 21 papers

21
329
1,188
84,462
Karsten Hahn retweeted
Kyle Cucci@d4rksystem
Aug 17
When RE’ing #malware with LLMs, have the LLM also write helper scripts (string/payload decrypters and config extractors) and run these manually on the malware binaries. These make it much easier to validate the LLM's RE quickly and can help expose hallucinations.
4
11
71
4,924
Blog: "Bad advice and myths around malware prevention" If you ever heard or said "visiting websites can't infect you", "PDFs aren't malicious" or "exploits are rare and always targeted" this article might be for you. blog.gdatasoftware.com/2026/… #GDATATechBlog #GDATA

Bad Advice and Myths Around Malware Prevention

Bad advice about malware prevention creates false confidence. Nuanced advice matters! Learn why websites, old exploits, and PDF files can still pose risks.

blog.gdatasoftware.com
12
34
2,558
New video: Compiled V8 JavaScript for reversers 🎥 ➡️ V8 compilation pipeline ➡️ bytecode caching ➡️ how bytenode abuses caching for protection piped.video/watch?v=YSSCMSMc… #MalwareAnalysisForHedgehogs #JavaScript #V8

Theory Compiled JavaScript - V8 compilation pipeline and Bytenode

Some threat actors distribute JavaScript as compiled V8 bytecode to...

youtube.com
1
19
66
5,927
Do you remember the BlockBlasters Steam game that was used to steal from a man with cancer? FBI arrested the threat actor techspot.com/news/113163-fbi…

FBI arrests 21-year-old accused of infecting 8,000 PCs with malware through fake Steam games

The suspect, identified by the FBI as Zyaire Dontaevious Zamarion Wilkins, is accused of running a sophisticated cybercrime operation with unnamed co-conspirators for nearly two years. The...

techspot.com
1
6
12
1,763
Related article for BlockBlasters at the time: blog.gdatasoftware.com/2025/…

Infected Steam game downloads malware disguised as patch

A 2D platformer game called BlockBlasters has recently started showing signs of malicious activity after a patch release on August 30. While the user is playing the game, various bits of information...

blog.gdatasoftware.com
1
436
I asked a clanker to make me a prompt that I can use to generate images of malware, like literal pictures that represent malware such as the ones used in samplepedia, not PE images. I got a warning for cyber abuse with threats to shut down my account o.O
8
1
28
4,237
I published an API tracer for kernel mode drivers using speakeasy emulation AI notice: It's vibe-coded. I manually analyzed ~20 drivers to verify and improve the output and tested with a corpus of ~100 drivers. github.com/struppigel/hedgeh…
1
25
82
10,961
New trainings sample on samplepedia Backdoor, obfuscated Python bytecode. 0/60 on Virustotal, which means it's still fresh. virustotal.com/gui/file/4ada… samplepedia.cc/sample/4ada60…
8
39
1,970
🦔 📹 Poison X kernel mode rootkit analysis ➡️ kernel mode driver theory ➡️ Ghidra markup ➡️ basic string deobfuscation #MalwareAnalysisForHedgehogs piped.video/watch?v=yx6AbXlO…

Malware Analysis - PoisonX rootkit, Kernel driver rootkit markup in...

We use Ghidra to analyze a small kernel mode driver that acts as a ...

youtube.com
1
18
90
6,599
Sample: samplepedia.cc/sample/db5d28…
5
1,059
I submitted a new sample to samplepedia.cc PoisonX rootkit. Video solution follows the next days. samplepedia.cc/sample/db5d28…
1
13
61
5,785
This seems to be a prevalent issue now: People vibe code security applications and the LLM generates real malware for testing. The generated test files rely on real threat actor infrastructure to download or exfiltrate. hxxps://github.com/DataDog/guarddog/blob/main/tests
2
16
50
7,605
Reported as issue: github.com/DataDog/guarddog/…

There is actual malware in test files · Issue #766 · DataDog/guarddog

Hello, I am a security researcher working for GDATA. Your test files directory contain actual malware. These test files were generated by an LLM, it seems. But they download and run malware from ex...

github.com
2
11
2,349
This one was a similar case
Karsten Hahn@struppigel
Feb 10
Look like the dev told an LLM to generate test files for a Shai Hulud detection app. The LLM complied and generated malicious test files. github.com/Cobenian/shai-hul…
1
4
2,804
Load more