Squiblydoo

Creator of Debloat and
Join the Debloat/CertGraveyard discord:

[Squiblydoo @SquiblydooBlog]

Why, hello there, #solarmarker.

https://t.co/KhchR59D09

[Squiblydoo @SquiblydooBlog]

We updated the blogpost.
After the original post:
- I saw the malware in the network I monitor
- Others reached out to me to share TTP
- Others have published about it
- We've connected it to other signers and malware

All the signers have been added to CertGraveyard

[Squiblydoo @SquiblydooBlog]

Interesting malware signed “Guangzhou Guoying Communication Technology Co., Ltd.” and now revoked.

Functional PDF editor with backdoor. My report has 3 C2, but have seen more:
https://t.co/pcGwDnPLan

[Squiblydoo @SquiblydooBlog]

@HackingLZ IPv6 my beloved

[Squiblydoo @SquiblydooBlog]

Trojanized PeaZip signed "Listenmaa Consulting Oy"

DLL swapped in for sideloading,
h/t @malwrhunterteam who found it while it was FUD on VT.
Certs been reported, getting detection now:

C2: apiupdated[.]com/Hrd50dFgjQW53n
157.173.16[.]197

https://t.co/kcyzBwpe3b

[Squiblydoo @SquiblydooBlog]

Not malware analysis related, but still a project maintained with pride:

Tkinterdnd2 0.7.0
Adds better pyinstaller hook support.
Narrows the number of binaries it picks up and properly supports Tcl9.

https://t.co/QSRrPSq3JJ

[Squiblydoo @SquiblydooBlog]

Signed "Lway Firmware" - 7th unique cert serial for them 🫥
h/t @malwrhunterteam

Microsoft teams lure -> BabaDeda loader -> CNCMachineRMS RAT

C2: wizardexpensive[.]com:
96.62.218[.]59

https://t.co/fs2qVYQHsh

[Squiblydoo @SquiblydooBlog]

Debloat 1.7.1 - https://t.co/Q10T7Ja25t

In 1.7.0, we added a "--no-extract" optional flag. This makes it easier to use Debloat in pipelines that expect only 1 item in return. Without it, it would extract NSIS installers automatically.

1.7.1 fixed the release bins for Tcl9

[Squiblydoo @SquiblydooBlog]

@ex_raritas @censysio @GreyNoiseIO Hello, brother
I do not have a license

[Squiblydoo @SquiblydooBlog]

In addition to this cert, we've also seen them using "JB Alpha Digital AB" and "1090 Fishing Mapp Oy"

The blogposts really have more indicators and information than I can fit in a tweet.

[Squiblydoo @SquiblydooBlog]

@malwrhunterteam shared two MSI installers with this signer "SOPHISTICATED SOFTWARES (PTY) LTD"

The first is a rust remote shell
https://t.co/tUoOUV8j7N

The second is a tool which calls itself CrocoRAT:
https://t.co/YIKUVrSINt
We've seen CrocoRAT a few times 🧵

[MalwareHunterTeam @malwrhunterteam]

Some sample: https://updatestates.blob.core\.windows.net/files/WindowsDefender.msi
A file named "WindowsDefender.msi" coming from Microsoft's network, with no AV vendor detecting it on VT and was signed using an SSL Corp given cert with name "SOPHISTICATED SOFTWARES (PTY) LTD" must be legit, right?
😂
🤷‍♂️

[Squiblydoo @SquiblydooBlog]

@watchtowrcyber There is a typo in the CVE year.

[Squiblydoo @SquiblydooBlog]

PackClient RAT signed "Zaozhuang ZhongStore District HaoYouhao Department"

Kernel driver signed "Xidao E-commerce Studio, Yishui County"

https://t.co/k6scupTeTo

Payload: 108.187.43[.]139:8080/china4[.]zip

C2:
91[.]204.224.87:8790
156[.]251.16.214:8790
161[.]248.14.20:8790

[MalwareHunterTeam @malwrhunterteam]

There's also a related file that is FUD on VT and was signed using a Certum given cert with name "Zaozhuang ZhongStore District HaoYouhao Department"...
🤷‍♂️

[Squiblydoo @SquiblydooBlog]

@tmechen_ @vxunderground For what it is worth, I'm not trying to take the fun out of malware analysis. I'm mostly running the AI analysis reports because there tends to be more malware than folk to analyze it.

[Squiblydoo @SquiblydooBlog]

@vxunderground Makes sense! Thanks for the explanation.

[Squiblydoo @SquiblydooBlog]

As mentioned by @500mk500 , the ISO seems consistent with CastleLoader -> NetSupport (and StealC).

@malwrhunterteam 's thread already covered most of the details, the C2 and such. My AI analysis mostly connects the dots: https://t.co/vhND5A6NUJ

CastleLoader: jumalputty[.]com
NetSupport: nizariuserp[.]com
StealC: crataga[.]site

[MalwareHunterTeam @malwrhunterteam]

Come across a very low detected, strange as fuck "setup.iso"... 100s of files, strange traffic to different domains/IPs, etc...
🤔
🤷‍♂️

[Squiblydoo @SquiblydooBlog]

Amazing: it somehow went from 1 detection on VirusTotal to 0

CertGraveyard volunteers report certificates for revocation, but in this case, the certificate was revoked before @malwrhunterteam shared it with us. We add it to our database and use these opportunities to investigate the malware anyway.

In his blogpost, @devmihaylov does an amazing job digging in and turning the malware inside out.

(Note: We can always use more volunteers to analyze malware, pivot on known bad indicators, tracking infrastructure and more. If you're interested, join the Discord and reach out: https://t.co/ZcWIqa6rKB.)

[devmihaylov @devmihaylov]

Malware Analysis on a fake “Active Call” Python RAT

msvci[.]com/files/.ini - stage 2 download
45[.]61[.]139[.]149 - download server
g[.]obrn[.]cc - C2 (behind Cloudflare)
64[.]7[.]199[.]7 - operator server

https://t.co/Wo9ojRKY3c

@SquiblydooBlog @malwrhunterteam

[Squiblydoo @SquiblydooBlog]

@G60930953 @malwrhunterteam I’ll admit, the lines between GhostRAT ValleyRAT and their components are pretty blurry for me. I haven’t kept on it as much as I’d like. I mostly look at it because of the code-signing certs, so your feedback is appreciated.

[Squiblydoo @SquiblydooBlog]

Gh0stRat variant signed "Zhengzhou Xiaoye Network Co., Ltd."
ca47e13a2980817e7849ddfef70312542ed11efaeba7b1b583161c06a440baf2

C2:
Primary: 103[.]82[.]53[.]214:7661
Backup: 103[.]82[.]53[.]214:80

https://t.co/f3joDsPihI
h/t @malwrhunterteam

[Squiblydoo @SquiblydooBlog]

Though the domains sound cute… your enterprise network probably shouldn’t be reaching out to these.

[Luke Acha @luke92881]

Some other potentially related domains:
biggerworldclassstandard[.]com
maximalmaxing[.]com
sparksetuptechnology[.]com
supporterupdate[.]com
biggerskills[.]com
familypenguins[.]com
jumpingpenguin[.]com
hedgehogsbunny[.]com
lesliemonkeyinfants[.]com
commonhedgehogs[.]com
fastestsprints[.]com
babychimpserenity[.]com

[Squiblydoo @SquiblydooBlog]

RdViewer RMM tool that deletes itself, signed "温江区明宇网络技术服务工作室"

C2: 1[.]14[.]146[.]76

https://t.co/mTv3qL9cc0

h/t @malwrhunterteam