Hollows Hunter: How to Detect Malicious Implants from the Windows Terminal

Letting an antimalware solution handle a threat on its own represents an ideal case. The real problem arises when a malicious element is advanced enough to evade traditional detection methods. Security experts and malware analysts know exactly what to look for, but if you're interested in exploring the tools they use, you need to download a copy of the Hollows Hunter software, which works from the Windows terminal.

If someone with no connection to the world of computing hears the phrase “Trojan horse”, they'll most likely immediately think of the classic story… but it has an additional meaning for us. A meaning associated with infections, performance problems, data loss, and even worse things. Users find themselves caught in an arms race, with malware developers learning and applying new tricks on one side, and analysis experts fighting with the code on the other. What can we do? Where should we look?

A good starting point is processes, and any possibility of malicious implants that might affect them. Total replacements of executables, “hooks,” “shellcodes,” memory patches, injections, “hollowing.” Some conventional antimalware solutions often ignore these aspects, but if you want to know more about them, or have doubts about their presence in a system, it's not a bad idea to download a copy of Hollows Hunter, a tool created by Polish malware developer and analyst Hasherezade.

What Does Hollows Hunter Do?

Hollows Hunter is based on another project by Hasherezade called PE-Sieve, and its goal is to scan all running processes to detect and dump any potentially malicious implant. I say “potentially” because neither of these two resources behaves like a natural antimalware. False positives are the order of the day, and sometimes a hook can be carried out for a legitimate purpose. Hollows Hunter's job is to detect their presence, not eliminate them.

How to Use Hollows Hunter

The good news is that Hollows Hunter is very easy to use. Decompress the file into a temporary folder, open a terminal with administrator privileges, type “hollows_hunter”, and let it do its work. If all goes well, the “Total Suspicious” count will remain at zero. To know the execution modifiers, just add /help or /? at the end.

Granted, Hollows Hunter is not a tool for beginners, and it doesn't claim to be. But any user conscious about their system's security, or interested in dipping their toes into the waters of malware analysis, should definitely download a copy.

Official site and download: Click here