MITRE ATT&CKsoftware (malware)
S0588 GoldMax
- Domain
- enterprise
- Platforms
- Windows, Linux
- Aliases
- SUNSHUTTLE
- Version
- 2.3
- Created
- 2021-03-12
Description
GoldMax is a second-stage C2 backdoor written in Go with Windows and Linux variants that are nearly identical in functionality. GoldMax was discovered in early 2021 during the investigation into the SolarWinds Compromise, and has likely been used by APT29 since at least mid-2019. GoldMax uses multiple defense evasion techniques, including avoiding virtualization execution and masking malicious traffic.
Related
Uses · MITRE ATT&CK (18)
- T1027.013 Encrypted/Encoded File sub-technique
- T1564.011 Ignore Process Interrupts sub-technique
- T1573.002 Asymmetric Cryptography sub-technique
- T1001.001 Junk Data sub-technique
- T1071.001 Web Protocols sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1497.001 System Checks sub-technique
- T1497.003 Time Based Checks sub-technique
- T1036.004 Masquerade Task or Service sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1027.002 Software Packing sub-technique
- T1053.003 Cron sub-technique
- T1053.005 Scheduled Task sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1016 System Network Configuration Discovery technique
- T1041 Exfiltration Over C2 Channel technique
- T1105 Ingress Tool Transfer technique
- T1124 System Time Discovery technique
References
- https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/ CrowdStrike StellarParticle January 2022
- https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ MSTIC NOBELIUM Mar 2021
- https://www.fireeye.com/blog/threat-research/2021/03/sunshuttle-second-stage-backdoor-targeting-us-based-entity.html FireEye SUNSHUTTLE Mar 2021