1. X
  2. Karsten Hahn
Log inSign up
Karsten Hahn
9,392 posts
Image
user avatar
Karsten Hahn
@struppigel
MalwareAnalysisForHedgehogs, Principal Malware Researcher at GDATA, he/him 🦔🌈🏳️‍⚧️
International
…nalysis-for-hedgehogs.learnworlds.com
Joined May 2014
781
Following
25.8K
Followers
RepliesRepliesMediaMedia

New to X?

Sign up now to get your own personalized timeline!

Create account

By signing up, you agree to the Terms of Service and Privacy Policy, including Cookie Use.

Terms·Privacy·Cookies·Accessibility·Ads Info·© 2026 X Corp.
Don't miss what's happening
People on X are the first to know.
Log inSign up
  • Pinned
    user avatar
    Karsten Hahn
    @struppigel
    Sep 1, 2025
    My intermediate level malware analysis course is there. 60% off for the next two weeks. …nalysis-for-hedgehogs.learnworlds.com/course/interme…
    31K
  • user avatar
    Karsten Hahn
    @struppigel
    Aug 27, 2025
    IDA, why are you doing this? I lost my work because IDA refused to save. I needed to reboot the system to get network connection again. Without network there is no licensing server available. Surely there must be a better way to not loose work?
    Image
    138K
  • user avatar
    Karsten Hahn
    @struppigel
    Nov 18, 2021
    COVID-19 map for Germany looks pretty bad. Except for Ludwigslust-Parchim. It was hit by ransomware.
    Image
    Image
  • user avatar
    Karsten Hahn
    @struppigel
    Sep 1, 2022
    As a malware analyst I sometimes receive Microsoft files which have been manipulated. E.g. infected by a virus and cleaned afterwards. Here are some indicators to recognize PE file manipulation. 🧵
  • user avatar
    Karsten Hahn
    @struppigel
    Sep 14, 2023
    My beginner's course for malware analysis is finally ready. 🎉🦔🦔🧫🧑‍🔬 Get access for free for the next 5 days by using the link below:
    Image
    Windows Malware Analysis for Hedgehogs - Beginner Training
    From udemy.com
    162K
  • user avatar
    Karsten Hahn
    @struppigel
    Sep 22, 2025
    We looked at #BlockBlasters malware last week and had it reported to Steam some time ago. Here are some findings. 🧵 (article is in publishing)
    Image
    84K
  • user avatar
    Karsten Hahn
    @struppigel
    Oct 23, 2025
    Windows API arsenal by @0x6970 for reversers blog.fautl.com/api-list.html
    Image
    Image
    33K
  • user avatar
    Karsten Hahn
    @struppigel
    Jan 23, 2023
    Tips to stay safe while working with malware samples. 1. Use different OS on the host machine than your analysis VM --> most malware will not be able to run there
    112K
  • user avatar
    Karsten Hahn
    @struppigel
    Jun 29, 2023
    RE Tip. If you want to decrypt obfuscated .NET strings, just call them from Powershell. E.g. this is xWorm config decryption. File: virustotal.com/gui/file/cb0a5…
    Image
    59K
  • user avatar
    Karsten Hahn
    @struppigel
    Feb 11, 2022
    This is JavaScript ➡️ utf-8.jp/public/aaencod…
    Image
  • user avatar
    Karsten Hahn
    @struppigel
    Dec 20, 2019
    Good tip of my colleague: This is how you can recognize 64 bit code wrongly interpreted as 32 bit code. It has lots of dec eax instructions because 0x48 is also used to signify 64 bit operand size. (32 bit interpretation is first picture, 64 bit second)
    Image
    Image
  • user avatar
    Karsten Hahn
    @struppigel
    Jun 14, 2019
    I found this advertisment for a #Ransomware #Removal Tool on Reddit this morning. Seems fishy? Let's take a look.
    Image
  • user avatar
    Karsten Hahn
    @struppigel
    Apr 10, 2023
    Tfw you take a malware analysis course and give a bad rating because of malware files. o.O
    Image
    81K
  • user avatar
    Karsten Hahn
    @struppigel
    Jul 11, 2017
    I made an info graphic about process injection. (I am not good at design though). #processinjection
    Image
Advertisement
Advertisement