Build1 distinct publisher3 min readPublished
FlexenseActivator.exe stays quiet until something answers its connectivity check. Simulating the network, rather than isolating the host harder, is what made the payload observable.
The Engineer · Build desk
Compiled by The EngineerSomething wrong?How this is made
A connectivity check costs a malware author almost nothing: one DNS lookup, one HTTP request, then a branch. An air-gapped analysis VM answers it clearly and unhelpfully. So the graduate writeup on dev.to substitutes for the network instead of removing more of it: REMnux at 192.168.56.10 running INetSim 1.3.2 for HTTP, HTTPS and DNS, FakeDNS pointing every lookup from the Windows VM at 192.168.56.20 back at those services, all on a host-only segment with no route out [3][4]. The author's framing is that this is what answers the sample's question with a yes [4].
Worth being precise about what the lab proves. The writeup reports the execution with the simulated services running, and describes the dormancy behaviour as a known technique rather than something measured against a paired run with INetSim switched off [5][20]. The gate is plausible and the setup is the right one; the A/B that would pin it to this SHA-256 is not in the material.
The static picture explains why runtime work was necessary at all. Entropy of 7.916 sits above the 7.5 line where packed or encrypted content lives, and about 99 percent of the theoretical ceiling of 8 [6][11]. PEStudio identified UPX v0.89.6 with a Delphi stub, and the UPX0 section carries zero bytes on disk against 790KB of virtual size, which is the decompression target [7][8]. On VirusTotal, 33 of 76 engines flagged the file, meaning 43 of them, roughly 57 percent, did not [9][10]. Yet Windows Security raised a threat notification at execution with Defender mostly disabled [12]. The file was not the signal; the behaviour was.
That behaviour is short. The process created six threads inside the first second, did its work, and exited within a few seconds without staying resident [13][14]. Anything sampling on a coarser interval than that watches an executable exit cleanly. What it leaves behind is a fake GoogleUpdater tree at two version paths at once, 136.0.7079.0 and 137.0.7129.0, each with updater.exe, a Crashpad attachments directory and uninstall.cmd, followed by injection into five separate GoogleUpdater processes launched with --update [15][18].
The two directories are the operational detail. Legitimate Google Update keeps one version directory, and the analyst reads the pair as mutual reinstatement: delete one and the other restores it [16][17]. That makes the count, not the name, the indicator, and it makes remediation-by-path unreliable for anyone who finds the first folder and stops.
None of this needs a clever delivery chain. The file arrives inside pirated RAR and ZIP archives for Flexense disk tools, with VirusTotal tracking 151 parent archives, all of them pirated bundles [2]. A user who downloads an activator has already agreed to run an unsigned binary, often with local AV turned down to make the crack work. The interesting engineering is on the defender's side, and it is a service simulator on a second VM, not a stronger box around the first.
Ranked by verification strength, evidence, and original report placement.
FlexenseActivator.exe is a trojan disguised as a software activation tool, SHA-256 18676ae2eaa48ac6037fa239d282acca0b6c7cd6c7d384abe6b5cd379f2c5e50, identified as family Trojan.Win32.Tiggre / Zpevdo.
The file is distributed inside pirated RAR and ZIP archives for Flexense disk management software (SysGauge, Disk Pulse Pro, Disk Savvy), and VirusTotal shows 151 tracked execution parent archives, all pirated Flexense bundles.
Analysis used two virtual machines on a host-only network with no internet access: a Windows 10 analysis VM with AV off at 192.168.56.20 and a REMnux gateway VM at 192.168.56.10.
The REMnux VM ran INetSim 1.3.2 simulating HTTP, HTTPS and DNS, with FakeDNS redirecting every DNS query from the Windows VM to INetSim, so the malware's connectivity check received an affirmative answer.
The author states that many modern trojans check for connectivity before acting and stay dormant on a disconnected analysis machine, so the analyst sees nothing.
PEStudio reported entropy of 7.916; normal executables fall between 5 and 7, and packed or encrypted content pushes above 7.5 on a 0 to 8 scale.
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Detailed but single-source and self-reported
The writeup supplies unusually specific, checkable artifacts — SHA-256, packer version, entropy figure, PE section sizes, dropped directory paths, injection counts, and verbatim INetSim/FakeDNS log lines — which raises evidentiary quality above typical anecdote. It is nonetheless one self-published practitioner account with no independent replication, no control run without network simulation, and no test of the asserted removal-resistant persistence, so the interpretive claims rest weaker than the observational ones.
One graduate lab, with real malware prevalence in the wild
Adoption evidence is thin and mostly indirect. On the technique side the only reported deployment is a single graduate-project lab using off-the-shelf tooling (REMnux, INetSim 1.3.2, FakeDNS); no other practitioner, team or vendor use is disclosed. On the threat side there is a genuine in-the-wild signal — 151 tracked pirated Flexense parent archives and detection by 33 of 76 engines — showing the sample circulates beyond the lab. Nothing in the source supports broader uptake numbers.
Headline causality outruns the reported experiment
The framing — that a fake internet rather than tighter isolation is what made the payload observable — is plausible and consistent with the observed NCSI check, but no run with INetSim and FakeDNS disabled is reported, so the decisive comparison is missing. Similarly, 'delete one version and the other reinstates it' is stated as mechanism without a removal test. The underlying observations (packing, drop paths, injection, detection ratio) are reported soberly, which keeps the overstatement moderate rather than large.
Portfolio-building practitioner post, no vendor stake
The piece is a first-person graduate malware-analysis project published on a developer blogging platform, so the visible incentive is reputational and portfolio-oriented, which favors a dramatic framing of the lab result. No product being sold, no vendor sponsorship, no pricing or commercial disclosure appears, and the tools named (REMnux, INetSim, PEStudio, Process Hacker) are commodity free tooling, so commercial distortion pressure is low.
Solid on artifacts, weak on causal conclusions
Confidence is moderate: the observational core is specific and reproducible from the published hash, but everything rests on one uncorroborated, partially truncated account with two untested interpretive leaps (simulation causality and dual-directory persistence). Facts such as the hash, packer, drop paths and detection ratio can be trusted at high confidence; the article's causal narrative cannot.
science
Exposed MCP servers are now a scanned entry point, and N4D's agent calls the tools itself1 distinct publisher
build
PyInstaller exits zero, then the real work starts: notarization traps that report success1 distinct publisher
security
PavinLoader: the lures keep changing, the MSBuild stage does not1 distinct publisher
build
Three green checks, and the root cron job was still sitting in /etc1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · August 25, 2026