CookUp follow-up: nine signing companies and 25 C2 domains behind the “useful app” installers

About this post: This is a follow-up to our post on the signed “CookUp” recipe installer. Thanks again to Luke Acha, whose research on the wider cluster helped get this started. Thanks also to cb_, who also did some investigation into the files and domains. This analysis and write-up were produced by Claude (Opus 5.5), working as an agent in Claude Code on a REMnux analysis VM. Tools used: Malcat, innoextract, 7-Zip, VirusTotal, Censys, and public ANY.RUN and Triage reports.

TL;DR

In our CookUp post we looked at a signed recipe-app installer whose server decides who gets the real payload. CookUp turned out to be one build among many. We have now tied installers signed by nine different companies to the same campaign, and those installers talk to 25 command-and-control (C2) domains. This post shares the full certificate list and the domains, so defenders can block them and certificate authorities can act on them. Several antivirus vendors label these installers as TamperedChef, the name already used publicly for “useful app” installers with a hidden loader.

• Same code, many names: every signer below has at least one installer carrying the same payload-unpacking code as CookUp, including the identical 32-byte constant we described in the first post.
• Nine signers, three countries: five US LLCs, three Ukrainian LLCs based in Kyiv, and one UK limited company. All of them hold EV certificates.
• 25 C2 domains: all of them sit behind Cloudflare, and most use install-themed or recipe/PDF-themed names.
• Lures: recipe apps, PDF tools, note-takers, game cheats and generic “download ready” installers. The app-themed ones really do install a working app.
• Still unknown: the final payload. The servers kept refusing to hand it out.

One loader, many costumes

The installers come in very different packages: Go programs like CookUp, .NET apps, NSIS installers with a doctored plugin, and Inno Setup installers. Some builds even hide the loader inside a fake copy of 7-Zip’s 7z.dll. On the surface they share little beyond the theme. Underneath, they all carry the same scrambler and the same constant used to unpack the hidden DLL, and that is what ties each signer below to the CookUp campaign.

They also share a habit we pointed out last time: the signature area in the file is padded with junk bytes, so Windows accepts the signature while many tools fail to show the file as signed at all. G DATA describes the same “bloated certificate” in its write-up on OpenSUpdater, and the trick also shows up in the Projextor installers G DATA reported, a similar campaign of trojanized Electron productivity apps.

OpenSUpdater turns out to be part of this same cluster. G DATA’s loader hides in recompiled open-source installer code, ships a genuine free app as cover, and hands off to its hidden DLLs through exports named cx1, cx2 and cx3, matching the chain Luke Acha documented for the Catchlight installers and the cx1 call in CookUp. More importantly, the recompiled 7-Zip installers G DATA described carry the same scrambler and the same 32-byte constant as CookUp, just assembled piece by piece in code instead of stored in one block. So their signer, Animated Productions, LLC, is in the certificate table below, and codeonicinc[.]com, the C2 domain G DATA reported for those samples, is in the domain list. (Note: G DATA also grouped a third, NSIS-based sample signed by Monetize forward LLC (talking to setupsoftwarecenter[.]com) with OpenSUpdater. We didn’t find the shared code in that file, so it isn’t in our tables.)

The certificates

All of these are EV (Extended Validation) code-signing certificates, the kind that requires the most identity checks on the company before it’s issued. A valid signature only tells you who signed a file, not whether it is safe. All of the certificates have been reported to their CAs and added to the CertGraveyard.

Some of these files show no signer on VirusTotal at all; that’s the padding trick above at work, not a missing signature. Four of the five US companies are registered in Wyoming or New Mexico, states that publish little about a company’s owners, and for four of the five the address in the certificate is in yet another state. Three of the nine are based in Kyiv.

The C2 domains

Every domain below is contacted by at least one installer from the signers above. For codeonicinc[.]com we rely on G DATA’s analysis of the OpenSUpdater samples. They all sit behind Cloudflare, so the IP addresses you’ll see for them are Cloudflare’s and not useful to block.

What we still couldn’t reach

As with CookUp, the servers decide per victim whether to deliver the real payload, and none of the systems we observed were picked. So we still can’t say what the final stage is. For some of the domains the traffic is encrypted, so we only know that the installers contact them, not the exact requests they send. We are also tracking two more signing companies whose installers look related, but where we haven’t found the shared code yet. They aren’t listed here until we can confirm them.

Advice

For regular users

• Download software from the vendor’s own site, not from “download ready” pages reached through ads or search results.
• A document that arrives as Document_123456.exe, PDF_123456.exe or CookingApp_123456.exe is a program, not a document. Don’t run it.
• A signature, even an EV one, is not a safety check. If the publisher’s name doesn’t match the product, stop.

For defenders

• Block the 25 domains below and alert on any host that resolves them.
• Hunt for files signed by the nine companies in the certificate table, especially if they were downloaded recently. Expect some clean-looking hits too: the Pausatech certificate also signed a disk-cleaning app that appeared harmless.
• Watch for freshly installed recipe, PDF or note-taking apps under %LOCALAPPDATA%\Programs\ coming from a Document_/PDF_/CookingApp_-style installer.
• If you capture a payload response from any of these servers, we would love to hear from you.

IOCs

Each row pairs a C2 domain with an installer that contacts it.

Wrapping up

CookUp was never a one-off. The same loader has been shipped under at least nine company names, across recipe apps, PDF tools, game cheats and generic “your download is ready” installers, and the app-themed ones still work as advertised on the surface. Reporting each certificate takes away one disguise, but the steady supply of new EV-signing companies shows how much the operators have invested in looking legitimate.

For the technical background on how the loader decides who to infect, see our original CookUp post. You can look up every signer above on the CertGraveyard.