← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Post-Quantum Crypto in a Go Trojan: A Garble-Obfuscated ASUS DLL Ships ML-KEM, a Fabricated DigiCert Chain, and Azure + Firebase C2
On April 9, 2026, a Go-compiled Windows DLL trojan was submitted to VirusTotal, which is identified by multiple detection platforms as WinGo/Agent_AGen.ACA and Trojan:Win32/Wacatac.B!ml. Packaged as an ASUSTeK Gaming Host Detection utility, it features significant obfuscation through Garble and contains a fabricated DigiCert Authenticode signature. Its distinct use of post-quantum cryptography, specifically ML-KEM alongside ChaCha20-Poly1305, is notably unusual for malware, as adoption of such technology in this context is largely absent from existing public records.
MITRE ATT&CK & Malware Families
Indicators of Compromise (8)
| TYPE | INDICATOR | DESCRIPTION | CREATED | |
|---|---|---|---|---|
| FileHash-MD5 | 3271ee162568f50a6810be9b8973807f | — | 2026-04-26 | |
| FileHash-MD5 | 85425de806a7373a22ce968eef1a561d | — | 2026-04-26 | |
| FileHash-MD5 | aad2f0b1a1de74557ffa6d6f9ef46170 | — | 2026-04-26 | |
| FileHash-SHA1 | 8930835f206921ae0db300f2ea7c69655e57523a | — | 2026-04-26 | |
| FileHash-SHA256 | 328e097831c74290f102dcf11c41bc4b7b82a37681d8df3690783ea8a9e3bebc | — | 2026-04-26 | |
| FileHash-SHA256 | 54c4d3d318017005f0f9faa89a3d04dcdfa348238fb6dfe72ba40356dd6d447d | — | 2026-04-26 | |
| SSLCertFingerprint | 26:44:73:dd:e1:e0:05:2b:ec:d0:46:c4:a6:8d:4f:a8:ad:11:a6:1f | — | 2026-04-26 | |
| domain | ck-3d80df5d12cdfe6450a782fc87bf66b444.google | — | 2026-04-26 |