cousin

b0ru

Between multiple public malware sandbox submissions, a YARA signature contributed to an open indicator repository by a malware researcher working for a security company repeatedly triggered detections of a modular C++ remote access tool.

The signature targets malware operated exclusively by one Chinese-aligned cyberespionage structure, and was publicly distinguished from a more famous relative during a conference talk.

The flag is the lowercase SHA1 of the concatenation, with no separators, no whitespace, and no surrounding characters, of the shared codename component and the implant’s environmental audio-surveillance activation threshold.

Format:

mntcrl{sha1(concatenated_string)}