Security Magic

CookUp: Suspicious Server-Gated Installer and Loader Analysis Malware Research / Technical Analysis Inside CookUp: A Suspicious Server-Gated Installer and In-Memory Loader CookUp is a recipe application distributed by an installer that also contains a suspicious, server-controlled remote-loading workflow. The installer drops/installs cookup.exe, a .NET recipe application with a limited JSON-based recipe database; in the observed installation, that application appeared functional and benign. The separate Go-based installer can activate a downloader and contains code for processing and loading native PE modules. No authentic second-stage payload was recovered, and malicious activity has not been established. Research date: October 29, 2026 · Platform: Windows 11 FLARE-VM · Architecture: 32-bit Go installer · Evidence: Ghidra, Frida 17.7.3, localhost HTTPS sinkhole · Updated October 29, 2026 with Frida V7 and Fiddler/Retrohunt follow-up Downloader Server-side activation Manual PE mappi...

Microsoft App Store publisher continues hosting undisclosed proxyware: StoreSocks proxyware campaign analysis and updates. I've observed some new stores and updated campaign behavior related to what I wrote about in Part 1 . Some changes include the Store publisher names, DLL file names, and a move from koffi to ffi-rs for the loading of the Go based proxyware binary. A detailed writeup on some of the new behaviors can be seen from HexaStrike who has named this campaign StoreSocks . I kind of like the name. Anyway, I don't intend this to be a long post, just some quick updates and observations on the campaign. New Publisher Names TECHNOLOGIES FOR BUSINESS LLC SOFTWARE MATTERS LLC New DLL file names: telemetry.dll /lib[A-Z0-9]{3}\.dll/ New C2: gate1.storetelemetryapiapps.xyz telemetrystoreapi1.xyz storetelemetryapi.xyz Additional Reading on recent Proxyware News: Nearly half of Smart TVs with Proxyware FBI Seizes NetNut Proxy Platform, Popa Botnet STORESOCKS – Microsoft Sto...

PureRAT analysis, PYC disassembly, shellcode, and Reactor .NET binaries extracted. IOCs and Detection. Executive Summary I analyzed a malware chain beginning with DriveVideoSetup-x64-0.1.0.exe , distributed through a fake Drive Video /SMVEO-themed lure. The malware uses a staged execution chain that moves from Python bytecode into shellcode, then into multiple protected .NET assemblies. The chain includes heavy obfuscation and encryption, runtime patching ,certificate generation, protobuf references, and authenticated WebSocket communications. Dynamic analysis observed the malware enrolling with infrastructure, creating certificate material under %LOCALAPPDATA%\SMVEO\ , connecting to agent.sm-veo.com , and logging agent starting 2.3.0 , auto-enrolling , and ws connection . Multiple indicators suggest this activity is DonutLoader leading to PureRAT . Execution Workflow DriveVideoSetup-x64-0.1.0.exe ↓ Persistence via CurrentVersion\Run ↓ python.pyc ↓ Base85 decode ↓ zlib de...

Analysis of fake utility installers delivering proxyware malware through Microsoft App Store. With findings related to Ghostsocks. Quick Summary A consolidated analysis of suspicious Microsoft Store utility apps, including WinDirStat and LightShot impersonators, that load a shared Go-based client.dll backconnect/proxy implant. Primary payload: client.dll Primary C2: mylabubus.shop Compiler: Go 1.24.9 Assessment: Backconnect / proxy malware Contents Executive Summary Key Findings Technical Analysis Evidence Summary Campaign Correlation Indicators of Compromise MITRE ATT&CK Mapping Responsible Disclosure Updates Executive Summary I analyzed a suspicious Microsoft Store utility package, focusing in particular on a WinDirStat impersonator. The analysis combined manual reverse engineering and runtime testing with AI-assisted workflows using REMnux MCP, Malcat MCP with Claude, and automated sandbox analysis. The application presented itself as a normal El...