Latest
Malware Analysis
A signed “crash handler” that only wakes up under the right name
A signed loader that does nothing unless it is named CrashHandler.exe or Updater.exe, talks to its server with forgery-proof replies, hides its payload as Logo.png, and delivers the…
Spyder, rebuilt: a Patchwork downloader that plays dead in sandboxes
Two builds of a lab-shy downloader reporting to cloudwindowapps[.]com turn out to be a new version of Spyder, a tool linked to the Patchwork espionage group. Their encrypted…
Reading a RAT’s Orders: SnappyClient 0.1.31 Behind a Signed Light Alloy Lure
A signed file posing as the Light Alloy media player delivers SnappyClient 0.1.31. A recorded session with its live server decrypted cleanly, showing automatic orders to steal crypto…
The captcha that can’t be passed: a signed “Installer.exe” that plants a remote-control updater
A signed Installer.exe shows a slide-to-verify captcha that always fails, while silently installing an updater that downloads and runs whatever a Cloudflare R2 manifest lists. The manifest was…
A signed “RMM agent” that hides the lure you just clicked: inside BlackCrypt
Two EV-signed files, a downloader and a "BlackCrypt RMM Agent", look like obscure IT software. Run with a real enrollment code, the operator's server immediately sent scripts to…
A signed PDF viewer that quietly takes orders: the QuartzLine “zenith” backdoor
An EV-signed Rust PDF viewer, QuartzLine, hides a backdoor module called zenith that can run commands and tamper with browser profiles. We decrypted its C2 traffic; public sandboxes…
A signed “video editor” that fakes its own failure and leaves two back doors behind
A signed fake video-editor installer shows a robot check and a fake driver error while installing two separate back doors: a SYSTEM service and a Node.js program that…
A signed loader, a Cobalt Strike Beacon, and C2 traffic dressed up as CrowdStrike
A three-day Microsoft Trusted Signing certificate, a ChaCha20 shellcode loader with side-door syscalls, and a Cobalt Strike Beacon whose traffic impersonates CrowdStrike Falcon.
The “Windows Update” That Writes Down Your Password
A signed fake Windows Update prompt that saves every password typed into it, wrong ones included, and shares an EV certificate with a hidden Xray tunnel DLL.
About
Rogue Authority LLC — cybersecurity consulting and open-source tooling for the security community.
View Projects