← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Post-Quantum Crypto in a Go Trojan: A Garble-Obfuscated ASUS DLL Ships ML-KEM, a Fabricated DigiCert Chain, and Azure + Firebase C2
On April 9, 2026, a Go-compiled Windows DLL trojan was submitted to VirusTotal, which is identified by multiple detection platforms as WinGo/Agent_AGen.ACA and Trojan:Win32/Wacatac.B!ml. Packaged as an ASUSTeK Gaming Host Detection utility, it features significant obfuscation through Garble and contains a fabricated DigiCert Authenticode signature. Its distinct use of post-quantum cryptography, specifically ML-KEM alongside ChaCha20-Poly1305, is notably unusual for malware, as adoption of such technology in this context is largely absent from existing public records.
MITRE ATT&CK & Malware Families
Indicators of Compromise (3 / 8 total)
| TYPE | INDICATOR | DESCRIPTION | CREATED | |
|---|---|---|---|---|
| FileHash-MD5 | 3271ee162568f50a6810be9b8973807f | — | 2026-04-26 | |
| FileHash-MD5 | 85425de806a7373a22ce968eef1a561d | — | 2026-04-26 | |
| FileHash-MD5 | aad2f0b1a1de74557ffa6d6f9ef46170 | — | 2026-04-26 |