Discover and read the best of Twitter Threads about #APT27
Most recents (1)
#ESETResearch discovered that #LuckyMouse/#APT27 used a code-signing certificate belonging to VMPsoft, the developer of the VMProtect packer. The signed file is a loader for the SysUpdate backdoor (aka Soldier). We notified VMPSoft of this compromise 1/4
virustotal.com/gui/file/a8527…
virustotal.com/gui/file/a8527…
Pivoting on the certificate, we found genuine VMPsoft binaries and a sample of SysUpdate signed and packed with VMProtect. Since LuckyMouse rarely use VMProtect, it is possible that they also stole VMProtect packer when they got the digi certificate. 2/4
virustotal.com/gui/file/cc196…
virustotal.com/gui/file/cc196…
While the certificate is still valid, we have notified GlobalSign.
Thumbprint: 6EF192CBD6E540F1D740D1BD96317ACAE8C6AF9D
Subject: Permyakov Ivan Yurievich IP, Ekaterinburg, Sverdlovskaya oblast, RU
Valid from: 2022-05-17 11:18:43
Valid to: 2023-05-18 11:18:43 3/4
Thumbprint: 6EF192CBD6E540F1D740D1BD96317ACAE8C6AF9D
Subject: Permyakov Ivan Yurievich IP, Ekaterinburg, Sverdlovskaya oblast, RU
Valid from: 2022-05-17 11:18:43
Valid to: 2023-05-18 11:18:43 3/4
