Felix Bilstein

Security Researcher
|
YARA-Rules for @malpedia using YARA-Signator

[DEATHCon @DEATHCon2025]

This is it folks! This is the last weekend to submit a DEATHCon workshop CFP proposal if you want to get in the first round of acceptance! We've got a lot of great submissions already but there's room for yours too! https://t.co/t7FI5GWiiT Click on CFP. Conf can pay for travel!

[Malpedia @malpedia]

A new set of auto-generated rules (courtesy of @fxb_b) has been published to Malpedia and GitHub. It includes 1590 updated rules and 26 new additions.

[Malpedia @malpedia]

A new set of auto-generated rules (courtesy of@fxb_b) has been published to Malpedia and GitHub. It includes 1460 updated rules and 136 new additions.

[Daniel Plohmann @push_pnx]

I have just published a new data set revision of MalpediaFLOSSed, now aggregating 5.6m unique strings gathered from 2.100 malware families. https://t.co/13bElmmIjI

[Malpedia @malpedia]

Here's a 2025 Malpedia recap for you: https://t.co/rxovQx53p6

[Karsten Hahn @struppigel]

I have spent way too much time on writing this #GootLoader JS unpacker and C2 extractor with abstract syntax tree manipulation. 🌳

But I could not stop at having it half done and this malware has 6 layers.

I am sorry for the terrible code.

https://t.co/GQpxUujMm1

[Karsten Hahn @struppigel]

Awesome project by malpedia creator @push_pnx presented at VB2023

Applied one-to-many code similarity analysis using MCRIT

Talk:
https://t.co/QHWu5fPEWg

[Fabian Marquardt @marqufabi]

Extractor updated 🎉 Should now support recent #DarkGate samples and can dump complete config and strings. Still some more Ghidra sessions needed to find out what all the new flags do 😂 https://t.co/lsuPDsmsQZ

[Daniel Plohmann @push_pnx]

I wrote a blog on new features in the IDA plugin for MCRIT, most notably being able to query basic blocks or the whole currently viewed function against a dataset like Malpedia in mere seconds, making it viable as a live companion while analyzing malware.

[Daniel Plohmann @push_pnx]

@mec314 As a follow-up to my previous response, I have now started populating another Github repo with ready-to-use reference data: https://t.co/V7OqL1zpIh I'm currently running automated extraction for all available MinGW versions and back-process my MSVC symbols for a first milestone.

[Malpedia @malpedia]

Another iteration of the YARA-Signator rule set has been generated by @fxb_b and has been published to Malpedia and GitHub. It includes 1273 updated rules and 44 new additions.

[ςεяβεяμs - мαℓωαяε яεsεαяςнεя & мαℓωαяε gεиεтιςιѕт @c3rb3ru5d3d53c]

I wrote a tool to find #YARA matches in #Ghidra using #Ghidrathon and Python, get it here! 👇
https://t.co/fsmOaDrEjH

[Daniel Plohmann @push_pnx]

I wrote a short blog post on MCRIT, the one-to-many code similarity analysis framework that we released as open source recently at @Botconf.

[Marc R @Seifreed]

We live in the automation era, recently I played with one of my favorite tools @radareorg main developers Mr. @trufae to automate the #malware analysis using it with @OpenAI

[Martin Henze @mrtnhnz]

After years of hard work, we finally open-sourced Wattson, our research testbed for investigating and analyzing the effects of cyberattacks on power grids: https://t.co/AQ0JdvGC7c

Kudos to @bader_lennart and team @RWTH @Fraunhofer_FKIE @Fraunhofer_FIT

[x64dbg @x64dbg]

The first commit of x64dbg was 10 years ago today (2013-05-19). Writing a retrospective is harder than I thought, but here is a screenshot of the first version as a sneak peak. Thanks to everybody in the community for the support over the years!

Duncan

[Malpedia @malpedia]

We just published a new iteration of the YARA-Signator rule set has been generated by
@fxb_b
and published it to Malpedia and GitHub. It includes 1272 updated rules with 33 new additions.

[Andre Pawlowski @sqall01]

I was always searching for a cool open source replacement for the 010 Editor. Since I rarely need it, buying it seemed a waste. But it seems my search is at an end. A colleage just send me https://t.co/EhmI9ulySs and the first impression is great!

[DFRWS @DFRWS]

After a great boat ride in the Rhine last night the Forensic Rodeo took place courtesy of the NFI Forensic Rodeo team!
Congratulations to the winning team JimmyThreePockets 🥇🥇
#DFRWSEU2023 #DFIR

[Dark Web Intelligence @DailyDarkWeb]

2023 Global Threat Report - by @CrowdStrike

"2022 was a year of explosive, adaptive and damaging threats. Adversaries continue to be relentless in their attacks as they become faster and more sophisticated."

https://t.co/fTxW0IP44s

#dailydarkweb #cybersecurity