Latest
Tag: remote-access-trojan
A signed “crash handler” that only wakes up under the right name
A signed loader that does nothing unless it is named CrashHandler.exe or Updater.exe, talks to its server with forgery-proof replies, hides its payload as Logo.png, and delivers the…
Reading a RAT’s Orders: SnappyClient 0.1.31 Behind a Signed Light Alloy Lure
A signed file posing as the Light Alloy media player delivers SnappyClient 0.1.31. A recorded session with its live server decrypted cleanly, showing automatic orders to steal crypto…
A signed “RMM agent” that hides the lure you just clicked: inside BlackCrypt
Two EV-signed files, a downloader and a "BlackCrypt RMM Agent", look like obscure IT software. Run with a real enrollment code, the operator's server immediately sent scripts to…
About
Rogue Authority LLC — cybersecurity consulting and open-source tooling for the security community.
View Projects