Karsten Hahn

MalwareAnalysisForHedgehogs, Principal Malware Researcher at GDATA, he/him 🦔🌈🏳️‍⚧️

[Karsten Hahn @struppigel]

My intermediate level malware analysis course is there.
60% off for the next two weeks.
https://t.co/q16H43ihoF

[Karsten Hahn @struppigel]

New release of PortexAnalyzer GUI v1.0.0 is public
X-ray your PE files

Release download: https://t.co/iVRhxI0tES

And a showcase video: https://t.co/0OWt4dI248

[Karsten Hahn @struppigel]

@vxunderground I (usually) stick to a specific level of prior knowledge so I do not have to explain the same things every time. And at some point I simply assume people watched prior videos (although I don't know).

Trying to cater to every level usually does not work well.

[Karsten Hahn @struppigel]

Next version of PortexAnalyzerGUI will be able to zoom in and out of the PE visualization, and allow you to interactively browse structures.

Will publish this weekend or so.

(unlisted 1 min video without audio)
https://t.co/xETYjOCxro

[Karsten Hahn @struppigel]

@PELock I have a chapter about the reasons for using Java for this project in my master thesis from 2015.
Judging from adoption of the library (e.g. by hybrid-analysis), it filled a hole.

Feel free to read reasons here (~p. 56) and consider it's 11 years old:
https://t.co/dfbmOaivUj

[Karsten Hahn @struppigel]

New PortEx release:
➡️ performance improvements for .NET files
➡️ support for interrupting analysis

https://t.co/RXtOWr3YUv

[Squiblydoo @SquiblydooBlog]

Interesting malware signed “Guangzhou Guoying Communication Technology Co., Ltd.” and now revoked.

Functional PDF editor with backdoor. My report has 3 C2, but have seen more:
https://t.co/pcGwDnPLan

[Karsten Hahn @struppigel]

"Hytale supply chain attack"
Blog about Java malware by @m3mdump

https://t.co/nvLKdawGf8

[Karsten Hahn @struppigel]

@SquiblydooBlog @malwrhunterteam That makes it obvious that the system is either broken or infected, so I kinda wonder what the motivation behind that is.

[Karsten Hahn @struppigel]

@vxunderground A worm that fights worms has been described by Peter Szor in 2005, The Art of Computer Virus Research and Defense, Section "Counterattacks", page 596 ff.

[Karsten Hahn @struppigel]

That's not logically sound. It's still slop just with less em dashes.

[Karsten Hahn @struppigel]

Same here https://t.co/Qa5VTLk2jg

[Karsten Hahn @struppigel]

IObit signature with lower case 'L' as in LObit. 🙄
https://t.co/HnLseBTFv1

[Karsten Hahn @struppigel]

@GDATA Someone pointed out to me that the full infection chain is outlined in this article from @_CPResearch_

(I am not sure it's the same malware, but it does sound like it)
https://t.co/JdwdLYkgIV

[Karsten Hahn @struppigel]

New blog: OpenSUpdater Hides in Recompiled 7zip SFX

#GDATATechblog @GDATA
https://t.co/4tPjvEOkTY

[Aryeh Goretsky {@infosec.exchange} @goretsky]

If you have purchased a ThinkNode M9 LoRA device from @Elecrow1/@ELECROW_JP, be aware the internally-mounted MicroSD card is infected:
https://t.co/SkOzppHPdH

[dark3v3 @dark3v3]

Samplepedia writeup. This was another easy sample from @struppigel Check it out and let me know what you think.

https://t.co/PZJa5dcgYt

[Karsten Hahn @struppigel]

BlueMoon exploit kit allows to infect systems if a user opens a link via Chrome or Chromium based browsers via v8 sandbox escape and RCE on Windows.

https://t.co/hG6Re2LUBi

[dark3v3 @dark3v3]

My write up for one of the easy samples on Samplepedia @struppigel

https://t.co/Uzyv9KxMvp

[Karsten Hahn @struppigel]

🦔 📹 New Video: Hooking V8 JavaScript

➡️ compiled V8
➡️ we write a reusable hook script
➡️ we overcome basic anti-hooking

#MalwareAnalysisForHedgehogs #V8 #JavaScript
https://t.co/MSPUxInOqq

[tmp.0ut @tmpout]

We are pleased to release tmp.0ut 5 Volume!

Get your viruses, rootkits, strange ELFs, weird machines, tiny files, cool art, and phresh beats here!!

https://t.co/tZLM50HOc0