Signed WindowsDefender.msi Installers Deliver a Rust Remote-Shell Agent

Summary

Analysis found signed WindowsDefender.msi and DefenderUpdate.msi installers deploying a Rust remote-shell agent. It executes attacker commands over HTTPS, and later builds used a new server; sandbox runs received no real orders.

Key points

The MSI installers, signed by SOPHISTICATED SOFTWARES (PTY) LTD, install a Rust program named c2_agent as %LOCALAPPDATA%\App\file_*.exe and launch it without requiring administrator rights.
The agent checks in with a server, polls for orders every three seconds by default, runs commands through cmd.exe or PowerShell, and returns encrypted results.
Orders and results use AES-256 with a hard-coded key; the HTTPS client disables certificate checking.
The first build contacted 136.0.96.24:443. Two later builds used 212.18.104.242:443 and differed mainly in server address and build metadata.
Sandbox testing demonstrated command execution against a researcher-controlled fake server. The public sandboxes observed no real orders, and the later server began disconnecting from them.
The researchers found no persistence mechanism or evidence of what the operator ran; attribution and malware-family identification remain unknown.
The article advises removing the installed App and its executable if encountered, changing passwords from a clean device, and hunting for the MSI-to-file_*.exe-to-shell process chain and the signing certificate.

Article Details

Attack Vectors: Malicious MSI installers named WindowsDefender.msi and DefenderUpdate.msi used Microsoft Defender branding and valid code-signing signatures to appear legitimate.
The installers copied a Rust payload into %LOCALAPPDATA%\App\ and started it through an installer custom action without requiring administrator rights.
The payload connected over HTTPS to attacker C2 IP addresses, polled for encrypted commands, and executed them through cmd.exe or PowerShell.
The payload reported command output to the C2 server using AES-256 encryption. The article reports that no real command was observed being sent to a sandbox.
Defensive Notes: Check that a file’s signer matches the product it claims to be; Microsoft Defender is not distributed to home PCs as a downloaded WindowsDefender.msi installer.
If affected, terminate the relevant file_N.exe process, uninstall “App” (publisher “App”), verify %LOCALAPPDATA%\App\ is removed, and change passwords from a separate clean device.
Hunt for msiexec.exe launching executables from %LOCALAPPDATA%\App\, file_*.exe spawning cmd.exe or powershell.exe, and the MSI upgrade code {CE318F29-2311-4B71-B208-8123456789AB}.
Monitor HTTPS to bare IP addresses on port 443 without SNI or ALPN, regular roughly three-second polling, and reconnect attempts 60 seconds apart.
With TLS inspection, look for POST requests to /reg containing type=p and no User-Agent header; the article says the agent ignores certificate errors.
Block or alert on certificate serial 473d28e38b9bc50abe922c40c214810c, and detect the payload using stable characteristics such as c2_agent.pdb and the VALID command word rather than relying only on changeable C2 addresses.

Indicators of compromise

Type	Indicator	Context
IPV4	`136[.]0[.]96[.]24`	C2 server used by the initial payload build over HTTPS on port 443.
IPV4	`212[.]18[.]104[.]242`	C2 server used by later payload builds over HTTPS on port 443.
SHA256	`0329c3dcb71f6ed5eed1d17f1e945612aeba5d67cc80699d734a2df64bba1cdf`	SHA-256 hash of the second malicious WindowsDefender.msi installer.
SHA256	`2548b7c1bda26e55dca101f8cfc781dbc6b5dba7eb7f3fafc5f968d468570502`	SHA-256 hash of the malicious file_1.exe payload.
SHA256	`5a60e00493e747b9bac53e965966a3dad0fbec740a221af0d371ec8fac5fb0f2`	SHA-256 hash of the malicious file_3.exe payload.
SHA256	`e3711177a50d16f873a478bc3de05b078eb176af8a69c47d4c7f25a8360a69c5`	SHA-256 hash of the malicious file_5.exe payload.
SHA256	`ebd865e5901bd5881f6a932d5f7a58e69ef54d25a58df50547e1b1fc8612789d`	SHA-256 hash of the malicious DefenderUpdate.msi installer.
SHA256	`fb6b0467ce17ed027f3e6eade7dc298b7ffece59c6f0150b57ada60259dde797`	SHA-256 hash of the malicious WindowsDefender.msi installer.
URL	`hxxps[:]//136[.]0[.]96[.]24/reg`	C2 registration endpoint used by the initial payload build.
URL	`hxxps[:]//212[.]18[.]104[.]242/reg`	C2 registration endpoint used by later payload builds.