Malware

GOBOT2

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

23 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1091Replication Through Removable MediaEvidence1

GoBotKR can drop itself onto removable media and relies on Autorun to execute the malicious file when a user opens the removable media on another system.

T1189Drive-by CompromiseEvidence1

GoBotKR has been distributed through torrent file-sharing websites to South Korean victims, using games or Korean movie/TV series as a lure.

Execution

3 techniques

T1053Scheduled Task/JobEvidence1

GoBotKR schedules a task that adds a registry run key to establish malware persistence.

T1059Command and Scripting InterpreterEvidence1

GoBotKR uses cmd.exe to execute commands.

T1204User ExecutionEvidence1

GoBotKR makes their malware look like the torrent content that the user intended to download, in order to entice a user to click on it.

Persistence

2 techniques

T1053Scheduled Task/JobEvidence1

GoBotKR schedules a task that adds a registry run key to establish malware persistence.

T1112Modify RegistryEvidence1

GoBotKR stores its configuration data in registry keys. GoBotKR can modify registry keys to disable Task Manager, Registry Editor and Command Prompt.

Privilege Escalation

1 technique

T1053Scheduled Task/JobEvidence1

GoBotKR schedules a task that adds a registry run key to establish malware persistence.

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence1

GoBotKR uses base64 to obfuscate strings, commands and files.

T1036MasqueradingEvidence1

GoBotKR uses filenames and registry key names associated with legitimate software.

T1070Indicator RemovalEvidence1

GoBotKR removes the Zone identifier from the ADS (Alternate Data Streams) of the file, to conceal the fact the file has been downloaded from the internet.

T1140Deobfuscate/Decode Files or InformationEvidence1

GoBotKR has used base64 to obfuscate strings, commands and files.

T1497Virtualization/Sandbox EvasionEvidence1

GoBotKR performs several checks on the compromised machine to avoid being emulated or executed in a sandbox.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

GoBotKR stores its configuration data in registry keys. GoBotKR can modify registry keys to disable Task Manager, Registry Editor and Command Prompt.

Discovery

5 techniques

T1016System Network Configuration DiscoveryEvidence1

GoBotKR uses netsh and ipconfig to collect information about the network configuration. It has used Naver and Daum portals to obtain the client IP address.

T1033System Owner/User DiscoveryEvidence1

GoBotKR uses whoami to obtain information about the victimized user. It runs tests to determine the privilege level of the compromised user.

T1082System Information DiscoveryEvidence1

GoBotKR uses wmic, systeminfo and ver commands to collect information about the system and the installed software.

T1124System Time DiscoveryEvidence1

GoBotKR can obtain the date and time of the compromised system.

T1497Virtualization/Sandbox EvasionEvidence1

GoBotKR performs several checks on the compromised machine to avoid being emulated or executed in a sandbox.

Lateral Movement

1 technique

T1091Replication Through Removable MediaEvidence1

GoBotKR can drop itself onto removable media and relies on Autorun to execute the malicious file when a user opens the removable media on another system.

Collection

1 technique

T1113Screen CaptureEvidence1

GoBotKR is capable of capturing screenshots.

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

GoBotKR uses HTTP or HTTPS for C&C.

T1090ProxyEvidence1

GoBotKR can be used as a proxy server.

T1105Ingress Tool TransferEvidence1

GoBotKR attempts to copy itself into public folders of cloud storage services (Google Drive, Dropbox, OneDrive). It is also able to spread itself by instructing the compromised machine to seed torrents with the malicious file.

T1132Data EncodingEvidence1

The communication with the C&C server is base64 encoded.

Impact

3 techniques

T1496Resource HijackingEvidence1

GoBotKR can use the compromised computer’s network bandwidth to seed torrents or execute DDoS.

T1498Network Denial of ServiceEvidence1

GoBotKR has been used to execute network DDoS.

T1499Endpoint Denial of ServiceEvidence1

GoBotKR has been used to execute endpoint DDoS attacks – for example, TCP Flood or SYN Flood.

INDICATORS OF COMPROMISE

IOCs tracked for this family

129 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

5 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

120 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

4 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app7 years ago

hash.sha1●●●●●●●●●●●●View more in app7 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

eset welivesecurity blogNews

Jul 8, 2019

Cybercriminals target South Korean users with backdoor-laced torrents

A publicly available Go-based backdoor whose source code served as the basis for GoBotKR. It includes botnet and backdoor capabilities and several anti-analysis and evasion features inherited by GoBotKR.

palo alto networks unit 42 blogNews

Jul 1, 2019

The Gopher in the Room: Analysis of GoLang Malware in the Wild

A Go-based malware family identified at scale in the dataset; the name and grouping indicate botnet-style functionality.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching129

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping23

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

GOBOT2

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

23 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1091Replication Through Removable MediaEvidence1

GoBotKR can drop itself onto removable media and relies on Autorun to execute the malicious file when a user opens the removable media on another system.

T1189Drive-by CompromiseEvidence1

GoBotKR has been distributed through torrent file-sharing websites to South Korean victims, using games or Korean movie/TV series as a lure.

Execution

3 techniques

T1053Scheduled Task/JobEvidence1

GoBotKR schedules a task that adds a registry run key to establish malware persistence.

T1059Command and Scripting InterpreterEvidence1

GoBotKR uses cmd.exe to execute commands.

T1204User ExecutionEvidence1

GoBotKR makes their malware look like the torrent content that the user intended to download, in order to entice a user to click on it.

Persistence

2 techniques

T1053Scheduled Task/JobEvidence1

GoBotKR schedules a task that adds a registry run key to establish malware persistence.

T1112Modify RegistryEvidence1

GoBotKR stores its configuration data in registry keys. GoBotKR can modify registry keys to disable Task Manager, Registry Editor and Command Prompt.

Privilege Escalation

1 technique

T1053Scheduled Task/JobEvidence1

GoBotKR schedules a task that adds a registry run key to establish malware persistence.

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence1

GoBotKR uses base64 to obfuscate strings, commands and files.

T1036MasqueradingEvidence1

GoBotKR uses filenames and registry key names associated with legitimate software.

T1070Indicator RemovalEvidence1

GoBotKR removes the Zone identifier from the ADS (Alternate Data Streams) of the file, to conceal the fact the file has been downloaded from the internet.

T1140Deobfuscate/Decode Files or InformationEvidence1

GoBotKR has used base64 to obfuscate strings, commands and files.

T1497Virtualization/Sandbox EvasionEvidence1

GoBotKR performs several checks on the compromised machine to avoid being emulated or executed in a sandbox.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

GoBotKR stores its configuration data in registry keys. GoBotKR can modify registry keys to disable Task Manager, Registry Editor and Command Prompt.

Discovery

5 techniques

T1016System Network Configuration DiscoveryEvidence1

GoBotKR uses netsh and ipconfig to collect information about the network configuration. It has used Naver and Daum portals to obtain the client IP address.

T1033System Owner/User DiscoveryEvidence1

GoBotKR uses whoami to obtain information about the victimized user. It runs tests to determine the privilege level of the compromised user.

T1082System Information DiscoveryEvidence1

GoBotKR uses wmic, systeminfo and ver commands to collect information about the system and the installed software.

T1124System Time DiscoveryEvidence1

GoBotKR can obtain the date and time of the compromised system.

T1497Virtualization/Sandbox EvasionEvidence1

GoBotKR performs several checks on the compromised machine to avoid being emulated or executed in a sandbox.

Lateral Movement

1 technique

T1091Replication Through Removable MediaEvidence1

GoBotKR can drop itself onto removable media and relies on Autorun to execute the malicious file when a user opens the removable media on another system.

Collection

1 technique

T1113Screen CaptureEvidence1

GoBotKR is capable of capturing screenshots.

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

GoBotKR uses HTTP or HTTPS for C&C.

T1090ProxyEvidence1

GoBotKR can be used as a proxy server.

T1105Ingress Tool TransferEvidence1

T1132Data EncodingEvidence1

The communication with the C&C server is base64 encoded.

Impact

3 techniques

T1496Resource HijackingEvidence1

GoBotKR can use the compromised computer’s network bandwidth to seed torrents or execute DDoS.

T1498Network Denial of ServiceEvidence1

GoBotKR has been used to execute network DDoS.

T1499Endpoint Denial of ServiceEvidence1

GoBotKR has been used to execute endpoint DDoS attacks – for example, TCP Flood or SYN Flood.

INDICATORS OF COMPROMISE

IOCs tracked for this family

129 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

5 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

120 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

4 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app7 years ago

hash.sha1●●●●●●●●●●●●View more in app7 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

eset welivesecurity blogNews

Jul 8, 2019

Cybercriminals target South Korean users with backdoor-laced torrents

palo alto networks unit 42 blogNews

Jul 1, 2019

The Gopher in the Room: Analysis of GoLang Malware in the Wild

A Go-based malware family identified at scale in the dataset; the name and grouping indicate botnet-style functionality.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching129

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping23

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.