Cert Graveyard Report
Certificate Signer: Darko Parun
Certificate Serial: 10 6D B4 1D F2 38 1F 38 58 AC D9 80 9B 90 4F 02
All Cert Graveyard entries are considered malware. Other files by the same certificate serial number should be considered suspect.
Wailsloader
a66c01c55a294a773c5a98b9f286b6ad32055668eb9fe8d77f1f0f55f1a481b1
10 6D B4 1D F2 38 1F 38 58 AC D9 80 9B 90 4F 02
Darko Parun
Certum Code Signing 2021 CA
2026-08-21 11:42:00
2027-08-21 11:42:00
2026-09-07 16:16:30 UTC
Same malware as:
| Revoked Signer Subject | Issuing CA | Serial Number (Hex) | Revocation Date & Reason | Malicious Payload Signed | Identical Threat Tradecraft Exhibited |
| :--- | :--- | :--- | :--- | :--- | :--- |
| **CODE LOFTS d.o.o.**<br>(Split, Croatia) | Certum EV CS 2021 CA | `269E0446274BE9FB84A828EFA3DB84F8` | **2026-09-05 05:18:10 UTC**<br>`privilege_withdrawn` | • `DocumSign.exe` (v34.2.5)<br>• `Signature Nib.exe` (v3.7.4)<br>• `JumpingRabbit.exe` (Smoke test) | • BSC Smart Contract DDR (`0x1D78...`)<br>• Covert Cyrillic `App.Dо()` trigger<br>• Machine-wide `Add-MpPreference -ExclusionPath C:\` |
| **Code Beyond d.o.o.**<br>(Zagreb, Croatia) | Certum EV CS 2021 CA | `19DBCE4E308A2479A8796E6AFAB9B7D8` | **2026-09-06 08:51:00 UTC**<br>`privilege_withdrawn` | • `AdPayWorks.exe` (v1.1.2 Store SFX)<br>• `AdPayWorks.exe` (Direct PE) | • Inverted 512B XOR 0xFF 7z header<br>• Cyrillic `App.Dо()` trigger<br>• Telegram DDR (`+3KxzpB3...`) -> `vuv.ktt4d.org`<br>• Machine-wide `Add-MpPreference -ExclusionPath C:\` |
| **PROGRAMVARE PARTNER ANS**<br>(Manger, Norway) | Certum CS 2021 CA | `184AF3D177711EAC2C281DE26E44F41B` | **2026-09-06 08:52:40 UTC**<br>`privilege_withdrawn` | • `T2Auth Bastion.exe` (v12.2.5 Store SFX)<br>• `T2Auth Bastion.exe` (Inner Wails Core) | • Cyrillic `App.Dо()` trigger<br>• Telegram DDR (`+iIoD9gf...`) -> `tab.teslatotto.org`<br>• Secp256k1 key derivation + AES-256-GCM<br>• 20s exit survey anti-close modal |
| **MINERALS GROUP AS**<br>(Stavanger, Norway) | GlobalSign GCC R45 EV 2020 | `0D17C66A5507ABFAA3B70C38` | **2026-09-04 16:46:59 UTC**<br>`unspecified` | • `TMS_Desktop.exe` (v2.0.3 SFX)<br>• `TMS Desktop.exe` (Inner Core) | • Inverted 512B XOR 0xFF 7z header<br>• Cyrillic `App.Dо()` trigger<br>• BSC Smart Contract DDR (`0x1D78...`)<br>• Machine-wide `Add-MpPreference -ExclusionPath C:\` |
| **HORECA tech d.o.o.**<br>(Zagreb, Croatia) | Certum EV CS 2021 CA | `2D6873822EEB8CAC36592A8F3C3FD634` | **2026-07-15 10:17:10 UTC**<br>`privilege_withdrawn` | • `test-install.exe` (GCleaner PPI Wails Binary) | • Standalone Wails binary<br>• Hidden window PowerShell process spawner<br>• Machine-wide `Add-MpPreference -ExclusionPath C:\` |