Yesterday two different people contacted me about two different projects on GitHub.

"Tito" DMd me about someone making a comment on GitHub claiming to have a patch for "synara" (Image 1)

"Robert Z" emailed about something similar on a different GitHub project (image 2).

Interesting.

Upon further investigation it turns out this exact file has been discovered online named:
- hb_patch_v1112
- registry_patch_v0.1.7
- rep_fix_v1.zip
- sodium_fix_v1
- log_fix_patch
blah blah blah (image 3)

Basically, someone is creating accounts on GitHub, going to open issues, and leaving a comment saying they've found a patch (it's likely automated, but whatever). The patch is malware.

It appears this campaign began around July 7th (yesterday) and is making its rounds pretty quickly.

When you look inside (hehe silly reference) it's a program written in Go. When the binary detonates it queries a remote host which resolves to ... Telegram. The Telegram channel description specifies a website. The website in the Telegram description is where the payload exfiltrates code too.

They're doing it this way because they can quickly change the Telegram channel description if the website they specify is taken down. It's basically a bootleg DNS resolver (image 4).

Anyway, this is StealC (based on YARA identifiers). This is (probably) a new malware campaign by someone using StealC. I like it. Very cool usage of GitHub spam combined with a bootleg ass DNS resolver on Telegram. It probably helps because I doubt Telegram is quick to take action with takedown requests.