Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The August 2021 entry, "PROPHET SPIDER Exploits Oracle WebLogic to Facilitate Ransomware Activity," identifies GOTROJ and notes "exploitation of CVE-2020-14882 and CVE-2020-14750." | “To me this looks like a golang backdoor used by multiple actors.” The timeline identifies the malware under the names GOTROJ, GOTROJ-related / gsh, and DARKDOOR.
The August 2021 entry, "PROPHET SPIDER Exploits Oracle WebLogic to Facilitate Ransomware Activity," identifies GOTROJ and notes "exploitation of CVE-2020-14882 and CVE-2020-14750." | “To me this looks like a golang backdoor used by multiple actors.” The timeline identifies the malware under the names GOTROJ, GOTROJ-related / gsh, and DARKDOOR.
The December 2017 entry, "The Shadows of Ghosts: Inside the response of a unique Carbanak intrusion," lists GOTROJ malware and states: "Attack involved exploitation of CVE-2017-5638." | “To me this looks like a golang backdoor used by multiple actors.” The timeline identifies the malware under the names GOTROJ, GOTROJ-related / gsh, and DARKDOOR.
“To me this looks like a golang backdoor used by multiple actors.” The timeline identifies the malware under the names GOTROJ, GOTROJ-related / gsh, and DARKDOOR.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“To me this looks like a golang backdoor used by multiple actors.” The timeline identifies the malware under the names GOTROJ, GOTROJ-related / gsh, and DARKDOOR.
"Carbanak has been reported using a custom golang backdoor named GOTROJ."
"Carbanak has been reported using a custom golang backdoor named GOTROJ."
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A proprietary tool in Gold Melody's remote-access and tunneling arsenal. The arsenal collectively supports arbitrary command execution, system-information gathering, and reverse tunnels to a hard-coded IP address; individual capabilities are not specified.
Go-based Windows backdoor used for persistent remote access. The cited reports describe installation as a Windows service, including the WindowsNTApp service name, and remote-access communication over TCP port 443. The researcher reports similarities among downloaded samples without conclusively resolving their family naming.
Go-based backdoor identified across reports covering activity from December 2017 through September 2022. The researcher correlates differently named samples using hashes, embedded strings, and shared command-and-control infrastructure. Samples appear under filenames including ctlmon.exe, winnta, and winnta.exe. The content links the backdoor to multiple intrusion campaigns and a Ragnarlocker-associated breach, but the researcher did not observe successful C2 connections in public sandboxes.
GOTROJ is a remote access trojan (RAT) used by the GOLD MELODY group to provide persistent access to compromised systems.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.