Researchers analyzed a signed loader that activates only under specific filenames, installs persistence, and retrieves the Zalmoxis stealer. The malware targets browser data, crypto wallets, and Chrome’s App-Bound Encryption key.
Analysis of two Windows downloader builds finds sandbox checks, persistence, and plain-HTTP beaconing. Their settings and target labels suggest a rewritten Spyder tool aimed at South Asian police; public sandbox runs received no next stage.
Analysis of a signed Light Alloy installer lure found SnappyClient 0.1.31, which targets crypto wallets, recovery phrases, Telegram sessions and browser data. Researchers decrypted its C2 traffic and identified new capabilities in the malware.
Analysis found a signed installer that displays an unwinnable CAPTCHA while silently installing an updater with recurring scheduled tasks. It can download and run files from a Cloudflare R2 bucket; at analysis time, the bucket served only a test file.
Sandbox analysis found that BlackCrypt’s signed Windows agent installs as a service, enables remote control and searches for fake DocuSign, Adobe and other installers to hide them. The report identifies blackcryptknight[.]com as a C2 domain.
Analysis of a signed QuartzLine PDF viewer found a hidden backdoor that checks in with C2 servers and can run commands or alter browser profiles. Four decrypted sessions showed no tasks; Sectigo has revoked the signing certificate.
Analysis of a signed Windows installer found two back doors: a SYSTEM-level service and a user-level program. The installer uses fake verification and failure screens; the back doors fetch instructions from servers, and one reports activity to Telegram.
Analysis of a signed Windows loader found it unpacks a Cobalt Strike Beacon configured to imitate CrowdStrike traffic. The Beacon did not contact its server in the sandbox, and delivery method and operational context remain unknown.
PolicyMgr.exe impersonates a German Windows Update prompt, saves every entered password in a local text file before checking it, and has no built-in upload capability. Researchers link it to another tool signed with the same certificate.