Why, hello there, #solarmarker. virustotal.com/gui/file/1e79…

We updated the blogpost. After the original post: - I saw the malware in the network I monitor - Others reached out to me to share TTP - Others have published about it - We've connected it to other signers and malware All the signers have been added to CertGraveyard

Trojanized PeaZip signed "Listenmaa Consulting Oy" DLL swapped in for sideloading, h/t @malwrhunterteam who found it while it was FUD on VT. Certs been reported, getting detection now: C2: apiupdated[.]com/Hrd50dFgjQW53n 157.173.16[.]197 rogueauthority.org/signed-pe…

Not malware analysis related, but still a project maintained with pride: Tkinterdnd2 0.7.0 Adds better pyinstaller hook support. Narrows the number of binaries it picks up and properly supports Tcl9. github.com/Eliav2/tkinterdnd…

Signed "Lway Firmware" - 7th unique cert serial for them 🫥 h/t @malwrhunterteam Microsoft teams lure -> BabaDeda loader -> CNCMachineRMS RAT C2: wizardexpensive[.]com: 96.62.218[.]59 rogueauthority.org/signed-te…

Debloat 1.7.1 - github.com/Squiblydoo/debloa… In 1.7.0, we added a "--no-extract" optional flag. This makes it easier to use Debloat in pipelines that expect only 1 item in return. Without it, it would extract NSIS installers automatically. 1.7.1 fixed the release bins for Tcl9

PackClient RAT signed "Zaozhuang ZhongStore District HaoYouhao Department" Kernel driver signed "Xidao E-commerce Studio, Yishui County" rogueauthority.org/signed-si… Payload: 108.187.43[.]139:8080/china4[.]zip C2: 91[.]204.224.87:8790 156[.]251.16.214:8790 161[.]248.14.20:8790

As mentioned by @500mk500 , the ISO seems consistent with CastleLoader -> NetSupport (and StealC). @malwrhunterteam 's thread already covered most of the details, the C2 and such. My AI analysis mostly connects the dots: rogueauthority.org/setup-iso… CastleLoader: jumalputty[.]com NetSupport: nizariuserp[.]com StealC: crataga[.]site

Amazing: it somehow went from 1 detection on VirusTotal to 0 CertGraveyard volunteers report certificates for revocation, but in this case, the certificate was revoked before @malwrhunterteam shared it with us. We add it to our database and use these opportunities to investigate the malware anyway. In his blogpost, @devmihaylov does an amazing job digging in and turning the malware inside out. (Note: We can always use more volunteers to analyze malware, pivot on known bad indicators, tracking infrastructure and more. If you're interested, join the Discord and reach out: discord.gg/dvGXKaY5qr.)

Though the domains sound cute… your enterprise network probably shouldn’t be reaching out to these.

RdViewer RMM tool that deletes itself, signed "温江区明宇网络技术服务工作室" C2: 1[.]14[.]146[.]76 rogueauthority.org/signed-di… h/t @malwrhunterteam

Gh0stRat variant signed "Zhengzhou Xiaoye Network Co., Ltd." ca47e13a2980817e7849ddfef70312542ed11efaeba7b1b583161c06a440baf2 C2: Primary: 103[.]82[.]53[.]214:7661 Backup: 103[.]82[.]53[.]214:80 rogueauthority.org/signed-se… h/t @malwrhunterteam

Nice to see another analysis of Quartzline published.

I never thought a malware with C2 like tabbyottercub[.]com motherotters[.]com westbeavers[.]com familypenguins[.]com was going to be such a pain. We've seen this family of malware going back several months, and I don't fully know what the end game is yet.

Signed "FILIP KOZJAK" and added to the Cert Graveyard. Regular reminder to be logged into VirusTotal even if it is a free account: If you're logged in, it shows you Proofpoint's Suricata detection for the file reaching out to Telegram.

Low detection Stealer, internally named "Zalmoxis". Uses a signer that we've seen from two other CA: "YOUR CHANCE j.d.o.o." ad0d08d54c9bbe2309bb7a8ae92def8a04297d0238f2799764d93929b57cbd5f rogueauthority.org/signed-cr… cdn[.]simplynetworking[.]eu Zalmoxis c2: 45[.]152[.]149[.]66:6969 Panel was on port 3000 Previously seen signed as "Komers Trading Company LLC" 1534e8091708e13a24698de848faccac0ccbf82cc625f990bed0c7ec5388c345 h/t to @malwrhunterteam We've seen this certificates for this signer issued by SSL, Sectigo, and GlobalSign

h/t @malwrhunterteam Signed EtherRAT dropping signed StealC: EtherRAT: 1b61b95a61996b44322e9841af2fa2b63fcdd18a569f16fa8acd30eb8d8ac854 Signer: "KARA-TASH I KO, OSOO" StealC: 37d7a8c504227f9c1986619fd8148f1737cf94e56ac91687f8ba33be7e945f5e Signer: "AirTiki ApS" C2: presanis[.]com Stealer Download: csg-soft[.]com / 45.135.180[.]185 StealC C2: glamour-studio[.]com / 194.11.226[.]153

This malware uses a non-functional captcha to distract the user. The installer is signed "HOLLIDAY DIGITAL LLC" and drops a trojanized aerodynamic design app signed by "Evelyn Paredes". Both have been reported and added to CertGraveyard rogueauthority.org/signed-in… h/t @g0njxa

This file was mentioned in Google/Mandiant's report here: cloud.google.com/blog/topics… Used in ShinyHunter's campaign against PeopleSoft. The file is an updated version of SnappyClient. See the analysis of the file here: rogueauthority.org/light-all…

This is our second EV cert from "C&P Global Investors LLC" signing "BlackCrypt RMM". We're calling bullshit. blackcryptknight[.]com, ws[.]blackcryptknight[.]com, devicehubcloud[.]com, apinetsolworkspace[.]network, 89.117.54[.]201 rogueauthority.org/blackcryp…