One Code-Signing Certificate Covers 14 WaveBrowser Bundleware Files
A single DigiCert-chained certificate issued to Wavesor Software signs an entire WaveBrowser/SWUpdater fleet — installer, updater, broker, resource DLLs, and browser runtime. Detection ratios swing wildly across engines while the signing identity stays constant underneath all of them.
A single leaf certificate — serial 09 D7 7A 45 C1 C0 97 55 AE 3E 7A 51 53 98 3C 03, issued to "Wavesor Software (Eightpoint Technologies Ltd. SEZC)" under the DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 chain — signs all fourteen core binaries CTX Team has catalogued for a browser-and-updater bundle marketed as WaveBrowser and its companion SWUpdater service.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read