Do we Call this Recipe App TamperedChef also?
CookUp: Suspicious Server-Gated Installer and Loader Analysis Malware Research / Technical Analysis Inside CookUp: A Suspicious Server-Gated Installer and In-Memory Loader CookUp is a recipe application distributed by an installer that also contains a suspicious, server-controlled remote-loading workflow. The installer drops/installs cookup.exe, a .NET recipe application with a limited JSON-based recipe database; in the observed installation, that application appeared functional and benign. The separate Go-based installer can activate a downloader and contains code for processing and loading native PE modules. No authentic second-stage payload was recovered, and malicious activity has not been established. Research date: October 29, 2026 · Platform: Windows 11 FLARE-VM · Architecture: 32-bit Go installer · Evidence: Ghidra, Frida 17.7.3, localhost HTTPS sinkhole · Updated October 29, 2026 with Frida V7 and Fiddler/Retrohunt follow-up Downloader Server-side activation Manual PE mappi...