Threats Tagged 'certificate bloating'

Threat actors are recompiling open source software, specifically the 7zip self-extracting archive stub, to embed a reflective loader that evades detection. The malicious code is inserted into the ExtractArchive function of the 7zip SFX module, making it difficult for analysts to identify since they typically focus on configuration files and embedded executables rather than the decompression stub itself. Samples are validly signed by Animated Productions, LLC and contain legitimate installers like foobar2000. The loader beacons to C2 servers, downloads DLLs, and reflectively loads encrypted payloads. Variants also abuse other open source libraries like the NSIS plugin EmbedHtml. Files feature bloated certificates and suspicious characteristics including installers wrapped within installers, requiring persistent analysis to uncover the hidden malicious functionality.