Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
At a glance Malware family GoSerpent backdoor, plus McMx, Stowaway, ThumbcacheService, and TmcLoader/TmcPayload
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Before executing McMx, attackers manipulate batch files to generate configuration files containing C2 parameters. The patterns observed show the use of echo commands to create configuration files with parameters like remote host addresses, ports, and secret keys.
The backdoor connects to command-and-control servers using ChaCha20 encryption for communications... Communications are transported over TCP, HTTP, or WebSocket channels with protection using AES-256-GCM or TLS encryption.
GoSerpent can establish SOCKS5 proxy servers to route traffic through compromised hosts... Stowaway... enabling attackers to establish chained proxy paths across multiple hosts with the following functionalities: SOCKS5 proxying port forwarding reverse tunneling
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as part of the malware/toolset associated with the GoSerpent espionage campaign, but no further functionality is described in the content.
A simpler Go-based proxy/RAT closely resembling older GoSerpent variants, using plaintext configuration files for C2 parameters and supporting SOCKS5 proxying, port forwarding, file transfer, and remote shell access.
Simpler Go-based proxy/RAT variant related to GoSerpent that uses plaintext configuration files for C2 parameters and supports SOCKS5 proxying, port forwarding, file transfer, and remote shell access.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.