Signed MSI files, Raccoon and Amadey are used for installing Serv Helper RAT
Summary: Cisco Talos traced a ServHelper RAT campaign to the TA505 crimeware group, which used MSI installers signed with a valid certificate from "SGP-GEOLOGIYA, OOO" to deliver a GoLang dropper that loads a .NET assembly from memory. The chain runs through PowerShell scripts that disable Microsoft's AMSI interface by patching AmsiScanBuffer, bypass UAC via the SilentCleanup scheduled task, and install either ServHelper or cryptominers, with one Ethereum address earning just over 17 ETH, worth slightly more than $33,000, in under four months.
What's compelling: The installers were signed with a valid certificate and, per Talos, were not detected by any antimalware software - so a signature check and a clean scan told defenders nothing about the payload.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026