Malware

GOSHELL

GOSHELL is a custom 64-bit Golang loader observed by Zscaler ThreatLabz in the Pakistan-linked (medium-confidence) “Gopher Strike” cyber-espionage intrusion chain targeting Indian government entities (first observed Sept 2025, ongoing as of Jan 2026). It is used post-compromise to deploy a final-stage, stageless Cobalt Strike Beacon.

Behavior and capabilities (as reported):

Loader/evasion: Inflates its PE size to ~1GB by appending repeated junk bytes to the PE overlay, likely to evade AV/static scanning.
Targeting control: Executes only on specific victim hostnames by checking the local hostname against a hardcoded allowlist and exiting if not matched.
Multi-stage decoding/execution: Decodes an embedded string via HEX decoding and XOR with 0xAA, sleeps 3–7 seconds, then executes second-stage shellcode via QueueUserAPC injection.
Decryption chain: Second-stage shellcode parses a PE header to extract a 4-byte XOR key (0x51211104) and decrypts the next-stage payload.
Payload: Final stage is a stageless Cobalt Strike Beacon.

Associated Cobalt Strike configuration extracted by ThreatLabz:

BeaconType: HTTPS over port 443
SleepTime: 45000 ms; Jitter: 30
C2: d18c3nlvb0n2a6.cloudfront.net
URIs: GET /jquery-3.3.1.min.js ; POST /jquery-3.3.2.min.js
User-Agent: "Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko"
Cookie-based metadata handling (e.g., "__cfduid").

Infection chain context (high-confidence linkage in reporting): Gopher Strike begins with spear-phishing PDFs that present a fake Adobe Acrobat update prompt; clicking “Download and Install” retrieves an ISO payload only when the requester is geolocated to India and uses a Windows User-Agent. Earlier stages include the Golang downloader GOGITTER, a persistent VBScript (windows_api.vbs) scheduled task mechanism, and the GitHub-C2 Golang backdoor GITSHELLPAD; GOSHELL is introduced later to load Cobalt Strike.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

firecompassNews

Jan 28, 2026

Weekly Cybersecurity Threat Brief: Major Breaches & Zero-Days

Golang shellcode loader used in the 'Gopher Strike' campaign; performs process injection via QueueUserAPC and decrypts/loads a staged Cobalt Strike Beacon into memory.

firecompassNews

Jan 28, 2026

Weekly Cybersecurity Threat Brief: Major Breaches & Zero-Days

Golang shellcode loader that injects/decrypts (XOR) and runs an in-memory payload (noted as Cobalt Strike Beacon) using QueueUserAPC process injection; includes large junk padding for evasion.

rescana blogNews

Jan 28, 2026

APT36 (Transparent Tribe) Escalates Cyber-Espionage Against Indian Government and Defense Networks Through Advanced Spear-Phishing and LNK Malware (2024-2025)

Loader used to deploy/execute Cobalt Strike Beacon as a follow-on payload in the described intrusion chain.

security online infoNews

Jan 28, 2026

"Gopher Strike": New Pakistan-Linked Cyber Campaigns Target Indian Government

Shellcode loader used to execute/deploy follow-on payloads, specifically Cobalt Strike Beacon.

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

GOSHELL

Behavior and capabilities (as reported):

Loader/evasion: Inflates its PE size to ~1GB by appending repeated junk bytes to the PE overlay, likely to evade AV/static scanning.
Targeting control: Executes only on specific victim hostnames by checking the local hostname against a hardcoded allowlist and exiting if not matched.
Multi-stage decoding/execution: Decodes an embedded string via HEX decoding and XOR with 0xAA, sleeps 3–7 seconds, then executes second-stage shellcode via QueueUserAPC injection.
Decryption chain: Second-stage shellcode parses a PE header to extract a 4-byte XOR key (0x51211104) and decrypts the next-stage payload.
Payload: Final stage is a stageless Cobalt Strike Beacon.

Associated Cobalt Strike configuration extracted by ThreatLabz:

BeaconType: HTTPS over port 443
SleepTime: 45000 ms; Jitter: 30
C2: d18c3nlvb0n2a6.cloudfront.net
URIs: GET /jquery-3.3.1.min.js ; POST /jquery-3.3.2.min.js
User-Agent: "Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko"
Cookie-based metadata handling (e.g., "__cfduid").

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

firecompassNews

Jan 28, 2026

Weekly Cybersecurity Threat Brief: Major Breaches & Zero-Days

Golang shellcode loader used in the 'Gopher Strike' campaign; performs process injection via QueueUserAPC and decrypts/loads a staged Cobalt Strike Beacon into memory.

firecompassNews

Jan 28, 2026

Weekly Cybersecurity Threat Brief: Major Breaches & Zero-Days

Golang shellcode loader that injects/decrypts (XOR) and runs an in-memory payload (noted as Cobalt Strike Beacon) using QueueUserAPC process injection; includes large junk padding for evasion.

rescana blogNews

Jan 28, 2026

APT36 (Transparent Tribe) Escalates Cyber-Espionage Against Indian Government and Defense Networks Through Advanced Spear-Phishing and LNK Malware (2024-2025)

Loader used to deploy/execute Cobalt Strike Beacon as a follow-on payload in the described intrusion chain.

security online infoNews

Jan 28, 2026

"Gopher Strike": New Pakistan-Linked Cyber Campaigns Target Indian Government

Shellcode loader used to execute/deploy follow-on payloads, specifically Cobalt Strike Beacon.

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.