Gold Max is a Golang written command and control backdoor used by the NOBELIUM threat actor group. It uses several different techniques to obfuscate its actions and evade detection. The malware writes an encrypted configuration file to disk, where the file name and AES-256 cipher keys are unique per implant and based on environmental variables and information about the network where it is running.
|2021-10-27 ⋅ Kaspersky ⋅ |
Extracting type information from Go binaries
|2021-10-26 ⋅ Kaspersky ⋅ |
APT attacks on industrial organizations in H1 2021
8.t Dropper AllaKore AsyncRAT GoldMax LimeRAT NjRAT NoxPlayer Raindrop ReverseRAT ShadowPad Zebrocy
|2021-06-01 ⋅ Cisco ⋅ |
Backdoors, RATs, Loaders evasion techniques
BazarNimrod GoldMax Oblique RAT
|2021-04-15 ⋅ CISA ⋅ |
Malware Analysis Report (AR21-105A): SUNSHUTTLE
|2021-03-08 ⋅ x0r19x91.gitlab.io ⋅ |
|2021-03-04 ⋅ Microsoft ⋅ |
GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence
There is no Yara-Signature yet.