Remote profile

Dawg, I got an e-mail from a student at FSU (Florida State University) jokingly asking if they're attending the University of Goop.

They received an e-mail from a student (who has surely had their e-mail compromised) telling them they need to review the Universities conduct policy, or something, and they must install "Zoho Assist"

Zoho Assist is a legitimate tool for remotely assisting people. But, some dorky ass Threat Actor is sending out these goofy social engineering e-mails hoping a student will install Zoho on their devices

My question for the Threat Actor: what if the student isn't running Windows? Many students use Apple products, or are running the infamous LINUX OPERATING SYSTEM, so what is your plan then?

Secondly, what's the plan then? Remotely access some broke ass college kids device and steal their $13 from their bank account?

I don't get it

There has been a glitch in the matrix. smica83 shared a heavily obfuscated .vbs which was first identified in Morocco, initially named "nouveau_cv_pdf.vbs".

I wasn't going to statically deobfuscate the piece of shit, so I emulated it. During emulation it catches it pulling a stage 2 binary from: https://qmlab1(.)com/assets/img/katyusha2

I curl the payload, look inside, and you're never going to believe it.

It's the exact same fucking binary I just discussed. It is the Go malware labeled internally as "EasyAgent"

I've never accidentally stumbled upon the same malware campaign, with different delivery methods, back to back like this. This is very silly

Dawg, we've got MORE goop (malware) targeting the trucking industry

Holy cannoli, bro. This unidentified Threat Group is super persistent and is really swinging for the moon to compromise trucking and/or material transportation companies

If you've been following my goop posts, you've seen now this is a reoccurring goop we've encountered and these nerds NEED to know where goods at being delivered.

The exploit kit:

https://bazaar.abuse.ch/sample/33d60d42472a83d0d2cf4ee6640c615313c29b18ce1e8ab06e41f4bba558a34b/

> be malwrhunterteam
> on a legendary run on social media
> find silly website
> estrosa-dot-it
> website for italian cosmetics
> legit website, used by the pasta people
> notice something silly on website
> /js/analytics/assets/js/group.html
> look inside
> group.html checks browser agent
> detects iOS version
> loads different files depending on iOS version
> loads 49554fde7424c31c.js
> 49*.js doing lots of crazy stuff
> layers of obfuscation and pointer arithmetic
> lolwtf
> look inside
> exact match of Coruna EK
> Coruna Exploit Kit
> Coruna originally used by US government
> rumored to be made by US contractor
> rumored US contractor illegally sold to kremlin
> UNC6353 (kremlin) found using Coruna in 2025

Chat, someone is swinging the legendary goop around. It is Coruna, the state-sponsored iOS exploit kit. All this requires is your Apple device to visit a website and (assuming you're running the targeted iOS version) you're cooked.

Although, from my initial bonking of it, it appears this delivers two different payloads depending on the iOS version. Unfortunately, I know almost nothing about iOS exploitation and iOS malware, so I have no idea what I'm doing. I encouraged my peers and colleagues to review it. It is good goop.

I've archived the payloads from the compromised domain. The shared link is below.

pic unrelated

Chat, we might have found the holy grail of goop. It is the goop of legend.