Cert Central has an unauthenticated API endpoint to return the database as a csv: certcentral[.]org/api/download_csv It used in CCCS' AssembyLine as a blacklist. @securityaura.bsky.social uses it for threat hunting github.com/SecurityAura... Looking forward to see what others do with it.

A team of journalists in Norway spent a year secretly monitoring a credit card fraud gang to uncover who's behind it and how they operate. Here's the story -- in English -- of how they unmasked Darcula and the crime-as-a-service software Magic Cat. www.nrk.no/dokumentar/x...

Scammers are happily abusing multiple platforms at once thanks to lack of controls. Who's going to protect users here? Google? Facebook?

Malicious ads target Semrush users to steal Google account credentials 📖 Read more: www.helpnetsecurity.com/2025/03/21/m... #cybersecurity #cybersecuritynews #accountcredentials #SEO @malwarebytes.com @jeromesegura.com @semrushofficial.bsky.social

If you manage #wordpress sites using #managewp, watch out for this #phishing campaign via #googleads. -> menagewp[.]com (ad URL and redirect) -> orion[.]manaqewp[.]com (phishing page)

Impostor certificate: EV Code-signing certificate "Yurisk LLC", used to sign fake NordPass installer. Abused and revoked within 1 week of issuance. Company registration says they transport freight.

Fake PuTTy, signed "Eptins Enterprises Llp" Sets scheduled task "Security Updater" and checks into IP address: 185.196.10.127 Triage: tria.ge/250401-wnbad... www.virustotal.com/gui/file/7ca... @jeromesegura.com

Fake SCPToolkit uploaded to MB by aachum: Signed EXE "jmutanen software Oy" loads an MSI and the real SCPToolkit as a decoy. Installs ScreenConnect: microsoftnet[.]ru Files from signer: bazaar.abuse.ch/browse/tag/j... Zip with parts: www.virustotal.com/gui/file/1df...

Signed DLL, 2/70 hits on VT? virustotal.com/gui/file/224... Actually easy to see it downloads from PasteBin and excludes C: I created a course with KC7Cyber to showcase and educate: kc7cyber.com/modules/VT101 I like to promote it because I know details like these get looked over.

Dang. Black Basta spending $500 to run a campaign and $4,000 for the Extended Validation certificate. 🤯 Great to see the code-signing certificate abuse the other side. Great use of Cert Central: tying certificates BB talked about back to the actual malwares.

Signed malware "Webber Air Investments LLC" First seen 23 days ago targeting YouTubers, rip. Vidar C2: 95.217.30.53 bazaar.abuse.ch/browse/tag/W...

Our SOC noticed that some attackers using the ClickFix and Fake Captcha technique are also providing text incase their payloads are read by AI or LLM. Learn more about fake captchas: expel.com/blog/expel-q...

Ya'll will start seeing more files signed by Microsoft. Please report them to centralpki@microsoft[.com or just tag me at a minimum, please. Microsoft has been good at revoking them This week I saw Lumma Infostealer QuasarRAT CobaltStrike (C2: uuuqf[.]com) www.virustotal.com/gui/file/401...

Fake MalwareBytes installer. Installs Zoom as a decoy: tria.ge/250308-wyeqk... Rhadamanthys, per VirusTotal's config extractor. virustotal.com/gui/file/4c2... C2: 185.33.87.209

www.malwr4n6.com/post/dealing... explains PE file padding and how to defeat one padding technique: manually and with tools (like with my debloat tool). 1/2

Fake Zoom reaches out to Namecheap domain ZoomInstaller[.]com Fake MagicApp also installs Zoom; reaches out to Github and Namecheap domain MagicVision[.]io Both suspiciously over 100MB due to .NET resource. tria.ge/250308-mqs4j... tria.ge/250308-mpm6x... Certificate reported.

Code-signing certs reported this morning: BlackmoonBanker signed by trading company "福州隋德洛贸易有限公司" Fake DeepSeek signed by pharma company "TRUONG LUU THUY PHARMA COMPANY LIMITED" Fake games, installs uTorrent, signed by construction company "MASTER SGDN BAU GMBH"

Ah yes, the Austrian construction company that makes my favorite games. www.virustotal.com/gui/file/e48...

I suspect that a lot of folk don't realize that a lot of the certificates Cert Central handles are for files that are not detected by any detection engine. Today's example was a 1Password Setup application. The file downloads the real 1Password as a decoy www.joesandbox.com/analysis/162...

Want experience doing malware analysis, categorizing threat actors, and other malware shaped things? We need more individual contributors for Cert Central. DM or email admin at certcentral . org As it turns out, we have a lot of malware to analyze.

Certificate signing DarkGate malware reported: "BLVS Tech Inc." DarkGate gets signed with a code-signing certificate fairly often. CertCentral.org is tracking 23 instances, I'm sure it happens more than that though. www.virustotal.com/gui/file/e92... bazaar.abuse.ch/browse/tag/B...

Cert Central .org is live! We track and report abused code-signing certs. By submitting to the website, you contribute to the DB of >800 certs—a DB you can access and view. Want to get more involved? Check out the Training and Research pages to learn more. 1/2

I am working on a public platform to make it even easier for people to report code-signing certificates. My goal is to continue to raise awareness on the abuse and the impact revocation has on malware distributors. Keep an eye on my socials for more news.

#Signed #Reported "44.211.848 NICOLAS SAMUEL DE ALMEIDA" Fake Open AI Sora downloads. User receives file "video_for_you.mp4 - openai\.com" You always know it is going to be a special time when the VT comments are stories. www.virustotal.com/gui/file/acd...

Signer "DRSSOFT INC" is pushing a lot of fake meeting software. Teams, Wechat, Zoom, etc bazaar.abuse.ch/browse/tag/D... RemcosRAT 185.42.12.75, 90MB "calc" 🥲 tria.ge/250127-l7pa9... Their files use a CloudFlare CAPTCHA before unpacking.

Anyone know what is up with the stealers that someone keep uploading as "random[#]"? #Signed PREMERA LLC Talks with telegram, installs netsupport, flagged as "RustyStealer" bazaar.abuse.ch/sample/1b173... www.virustotal.com/gui/file/1b1...

Low detection CobaltStrike masquerading as MS_Teams installer. Connects to C2: 217.148.142.17 #Signed "ANALYZER ENTERPRISES LLP" #Reported www.virustotal.com/gui/file/23d... bazaar.abuse.ch/browse/tag/A...

Interesting report from Twitter: "Another certificate was acquired by this company and used to sign a malicious kernel driver. The driver injects an IIS module into w3wp.exe, embedding JS into webpages that redirects to a Chinese adult site, tricking users into downloading a spyware-like app."

Dear YouTubers, keep an eye out still for fake agreements. I'm doing my part in reporting the code-signing certificates on signed malware. Low detection Lumma Stealer: www.virustotal.com/gui/file/24a... bazaar.abuse.ch/sample/24a26...

I see PDFSkills has a new code-signing certificate "BLACK INDIGO LTD". #EV #ImpostorCert #Reported Please don't let your employees use "Free" PDF editing tools. virustotal.com/gui/file/1c3...

Reminds me of the "Please Subscribe" I used when demo-ing my debloat tool with John Hammond. 72 MB of garbage. youtube.com/watch?v=q4Y5... More 🔗 in comments

700MB signed Lumma uploaded to MalwareBazaar. (Too big for VirusTotal). To my amusement, someone had already used my debloat tool, deflated it to 12MB, uploaded it to VT 6 days ago. Thanks for everyone that shares my tool, I hope even more people will use it. :) 🔗 in comment

More great examples why you need to give employees a trusted PDF tool pdfskillspro[.]com pdskillsapp[.]com Literally uploads files to their servers while saying they don't.

This Russian targeting PUP keeps showing up in my feed. However, they follow the honest practice of having you formally agree to the dozen browsers and other junk that you install with their installers. Example installer for roblox: app.any.run/tasks/32f5d5... Example list of files in img

"Word to PDF" converter. "HOTEL FATAZ (PRIVATE) LIMITED" signed the installer and the app is unsigned. The app can create firewall exclusions, Windows Defender exclusions, and execute arbitrary PowerShell. Everything you could ask for from a productivity tool. /s 🔗 in comment

Sign of legitimate applications: Methods with the following names: Awkward Impossible Unveil Jeans() Taken Pool Invest Mango() Catch Observe Secret Kitten () #impostorCert "KEMROSE ENTERPRISES LTD" Signing fake AutoCAD, Adobe, Pocket Universe, and more

Unsigned FUD "Electrum-USDT" drops a signed binary signed by "Netzsh Scientific Instruments TRADING(Shanghai) Ltd." Images: Report to issuer with more explanation about sus activity #malcat flagging PowerShell attrib +h / bitsadmin-transfer in installer anyrun_app anti-analysis indicators

(Sharing in collab with AnyRun) Using AnyRun, I was able to run this PERFECTLY NORMAL WeChat Installer: 0/69 VT score, Signed by "Commander Software Solutions Oy" While running it, it required me to complete a captcha and also install .NET runtime. 1/2

#ImpostorCert "Pay 2 Services Company Limited" submitted for revocation. When training analysts on VirusTotal, I point them to look at the "Names" section on the Details tab (see image). My fun VirusTotal training is free on KC7Cyber: kc7cyber.com/modules/VT101 bazaar.abuse.ch/sample/0467e...

It always does my heart good when my automation tells me a signed malware has been uploaded to MalwareBazaar, but when I check, the cert has already been revoked. VT score of 2/72 The other two files from this signer were 0/72 So for whoever else is going hamm, thank you.

certReport 3.1.4 Bugfix - indicators could be printed in duplicate certReport makes reporting code-signing certs easy. No-one likes spending time reading or writing reports. That is: I just noticed the problem. Maybe someone else did. I don't know. It is gone now.

Code-Signing cert "FUJI FURUKAWA E&C (VIETNAM) CO.,LTD" This signer was used to sign some low detection malware and some not so low detection #malware. bazaar.abuse.ch/browse/tag/F... Reported using certReport: github.com/Squiblydoo/c... see default report below. Please report certs. :)

The certificate on this malware caught my eye. 👀 Starts with Google Ad, malware signed by Microsoft, and ends in support scam. It checks if Quickbooks is running, checks the day of week, tells you to call a "support" number before killing Quickbooks. www.malwarebytes.com/blog/scams/2...

May 13, 2024 blogpost It is common for malware to be signed with code signing certificates. How is this possible? Impostors receive the cert directly and sign malware. In this blog-post, we look at 100 certs used by #Solarmarker #malware to learn more. squiblydoo.blog/2024/05/13/i...

If you want to discuss malware, my debloat tool, infosec, cross-disciplinary insights, or have a community to hangout with, join the Debloat Discord: discord.gg/dvGXKaY5qr The goal is a friendly community for learning. (animation by me)

I'm proud to say my tool to reduce the size of bloated malware is used by the Canadian Centre for Cyber Security (CCCS)'s AssemblyLine tool. AssemblyLine is a tool to automate file analysis. Debloat is part of the extract-service. github.com/Squiblydoo/d... github.com/CybercentreC...

Low Detection #SolarMarker #Infostealer #EV #SIGNED LAABAI LTD C2: 146.70.40.228 C2: 212.237.217.133 Triage: tria.ge/230821-2lmhj... VT: virustotal.com/gui/file/a01... MB: bazaar.abuse.ch/sample/fd834... Backdoor: bazaar.abuse.ch/sample/b44f8...

Debloat 1.5.0 https://github.com/Squiblydoo/debloat New use case: NSIS Installers. Debloat outputs the contents to a directory. NSIS reverse engineering credit goes to huettenhain on Twitter. I repurposed his NSIS parser from Binary Refinery: https://github.com/binref/refinery/tree/master

Low detection SolarMarker Infostealer C2: 91.206.178.106 C2: 193.29.56.179 Signed: "CHILL ANAESTHESIA LTD." VirusTotal: 3/66 c6fda8a049ebd7872358acfa2505f226e931e0f71090c19412e7b6d0a1c6e129 Backdoor: 511637bf26adb8ac42cec6f38da7cc25ceee118e4a5f09e61bfc39defbc97809