GopherMalware

“… GOSHELL shellcode loader was designed to execute only on specific hostnames by comparing the victim's hostname against a hardcoded list.T1027.001Defense Evasion, Obfuscated Files or Information: Binary PaddingThe threat actor used the GOSHELL shellcode loader that was inflated t…”

“…ommands and executed.If the response from the primary URL is empty, the script retrieves the secondary URL.To achieve persistence, a scheduled task is created with a dynamic name (MicrosoftEdge_ConfigurationUpdate_<__random__>) where a random four digit number is generated…”

“…formationThe Cobalt Strike Beacon loader decodes the second-stage shellcode and the Beacon payload using HEX-decoding and XOR operations.T1036.004Defense Evasion, Masquerading: Masquerade Task or ServiceThe GOGITTER downloader creates a scheduled task, MicrosoftEdge_Configur…”

“… APIThe GOSHELL shellcode loader used the QueueUserAPC native API call to execute the second-stage shellcode within its own process.T1053.005Persistence, Scheduled Task/Job: Scheduled TaskThe GOGITTER downloader created a scheduled task to execute a dropped VBScript every 50…”

“…malware drops files with names intended to appear legitimate, such as windows_api.vbs, adobe_update.zip, and edgehost.exe.T1055.004Defense Evasion, Process Injection: Asynchronous Procedure CallThe GOSHELL shellcode loader executed a second-stage shellcode within i…”

“…ing LinkThe threat actor used phishing PDFs which contained a lure with a ‘Download and Install’ button, linking to a malicious ISO file.T1059.003Execution, Command and Scripting Interpreter: Windows Command ShellGITSHELLPAD executed commands such as net user, systeminf…”