SYMBOLCOMMON_NAMEaka. SYNONYMS
win.goldmax (Back to overview)

GoldMax

aka: SUNSHUTTLE

Actor(s): UNC2452


Gold Max is a Golang written command and control backdoor used by the NOBELIUM threat actor group. It uses several different techniques to obfuscate its actions and evade detection. The malware writes an encrypted configuration file to disk, where the file name and AES-256 cipher keys are unique per implant and based on environmental variables and information about the network where it is running.

References
2021-10-27KasperskyIvan Kwiatkowski
@online{kwiatkowski:20211027:extracting:14de2bc, author = {Ivan Kwiatkowski}, title = {{Extracting type information from Go binaries}}, date = {2021-10-27}, organization = {Kaspersky}, url = {https://securelist.com/extracting-type-information-from-go-binaries/104715/}, language = {English}, urldate = {2021-11-03} } Extracting type information from Go binaries
GoldMax
2021-10-26KasperskyKaspersky Lab ICS CERT
@techreport{cert:20211026:attacks:6f30d0f, author = {Kaspersky Lab ICS CERT}, title = {{APT attacks on industrial organizations in H1 2021}}, date = {2021-10-26}, institution = {Kaspersky}, url = {https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf}, language = {English}, urldate = {2021-11-08} } APT attacks on industrial organizations in H1 2021
8.t Dropper AllaKore AsyncRAT GoldMax LimeRAT NjRAT NoxPlayer Raindrop ReverseRAT ShadowPad Zebrocy
2021-06-01CiscoJosh Pyorre
@online{pyorre:20210601:backdoors:577a28b, author = {Josh Pyorre}, title = {{Backdoors, RATs, Loaders evasion techniques}}, date = {2021-06-01}, organization = {Cisco}, url = {https://umbrella.cisco.com/blog/cybersecurity-threat-spotlight-backdoors-rats-loaders-evasion-techniques}, language = {English}, urldate = {2021-06-24} } Backdoors, RATs, Loaders evasion techniques
BazarNimrod GoldMax Oblique RAT
2021-04-15CISAUS-CERT
@online{uscert:20210415:malware:27f4af4, author = {US-CERT}, title = {{Malware Analysis Report (AR21-105A): SUNSHUTTLE}}, date = {2021-04-15}, organization = {CISA}, url = {https://us-cert.cisa.gov/ncas/analysis-reports/ar21-105a}, language = {English}, urldate = {2021-04-16} } Malware Analysis Report (AR21-105A): SUNSHUTTLE
GoldMax
2021-03-08x0r19x91.gitlab.ioSuvaditya Sur
@online{sur:20210308:sunshuttle:a45d8a5, author = {Suvaditya Sur}, title = {{Sunshuttle Malware}}, date = {2021-03-08}, organization = {x0r19x91.gitlab.io}, url = {https://x0r19x91.gitlab.io/post/malware-analysis/sunshuttle/}, language = {English}, urldate = {2021-03-11} } Sunshuttle Malware
GoldMax
2021-03-04MicrosoftRamin Nafisi, Andrea Lelli
@online{nafisi:20210304:goldmax:f699172, author = {Ramin Nafisi and Andrea Lelli}, title = {{GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence}}, date = {2021-03-04}, organization = {Microsoft}, url = {https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/}, language = {English}, urldate = {2021-03-07} } GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence
GoldMax

There is no Yara-Signature yet.