> be me > get dm > "smelly i found goop" > wtf i love goop (malware) > "Our EDR picked up unusual activity on the network. It was flagged as CLOUDHAZE a/k/a UNC7072" > ok > gibs files > literally nothing on CLOUDHAZE > literally nothing on UNC7072 > listed as primarily targeting healthcare > crickets > tf is this goop? > look inside > Rust malware > make quick initial assessment > say has weird anti-emulation stuff > be wildly inaccurate > be a doofus > post inaccurate information on internet > prolly shouldnt write about bonking goop at 3am while sleep deprived > nobody calls me out > calling myself out rn for being doofus > resume bonking > malware only runs when command line arguments passed > "--check" or "--check-gui" > if no command line, dies > ok > keep looking > malware has bunch of stuff inside > deobfuscates stuff inside itself > dynamically builds C2 domains > connects to C2 domains via HTTPS > sends POST > emulate > goop does its thing, connects to C2 > authenticates > radio silence > operators likely watching and waiting > goop doesnt automatically deliver more goop > ok > keep digging > goop can accept commands from operator > create process and redirect I/O > read files > likely has campaign ID associated with it internally > dm goop giver back > lol r u in healthcare bro? > "No, I work for a large Oil and Gas company in Europe" > company v v valuable to EU for strategic reasons since Ukraine Russia conflict > hmmmm Chat, I'm absolutely stumped. I have no clue what the actual fuck I'm looking at. I don't know if this state-sponsored malware, or a really dedicated financially motivated Threat Actor who cares deeply about their operational success. State-sponsored malware would align with potential motives for espionage. However, it would also align for a financially motivated Threat Actor who could make immense money if a compromise was successful. I wish I could allocate more time to bonking this malware, unfortunately more malware needs bonking. Maybe someone else can pick up on this, a colleague, company, some stinky nerd, whoever or whatever. C2s: topsmagnificentgrade(.)com tabbyottercub(.)com flawlessgradecheered(.)com Stager: 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3 Payload: 74aaa6b54133bbb2e77b2ae874e9900a907c269058f798a0a1197288ba1f7124 Unusual strings I don't understand: - "Caira" - "GUJONQGNQCLYEYJ"

> be me > get DM > "smelly i found goop" > wtf i love goop (malware) > "It's Linux malware. The malware was" blah blah blah > long lore story about something > something about anime or something > idk wtf theyre talking about > idc > just want goop > download file > look inside > big ass fuck off obfuscated bash script > aes-256 encrypted stuff > some hex encoded stuff > hex encoded string > /.config/.pipeaudio/.env > tries to copy itself there > more hex encoding > ~/.config/systemd/user/flawless.service > sets description for service > something about apple music > neat > uses JSON rpc stuff > omfg its this smart contract bs again > json rpc to proxy.lmfaoxd(.)lol > abi encoded strings > aes-256 encrypted thingie > aes-256 decryption key for aes-256 stuff in bash > password: "bb344490dd24c88cb9389839bf0709d72a7beeec149bd790914d77ac0033f96f" > aes-256 decode > fails > realize URL is base64 encoded twice > wtf > decode > decrypt again > bucket.lmfaoxd(.)lol > bash script appends to this decrypted url > /amd64, /arm64, /386 > neat > downloads from directory based on pcs cpu > neat > download > decrypt > 41mb file > damn wtf das a big file > look inside > written in Go > metadata stripped > wtf bro > strings give off a smell, a smelly smell > a smelly smell that smells like SliverC2 > heavily obfuscated using Garble > ye its SliverC2 C2: lmfaoxd(.)lol bucket.lmfaoxd(.)lol proxy.lmfaoxd(.)lol Smart Contract: 0x0000000000d2dCC83D913bd90653b2ef69340f87 Loader: ed11f431ce9bda16dd98558ec996c53a80841083c0c00deef215c2b0889d1b34 Sliver Payload (decrypted): 2c01c232d9d054efd6949695c3c7aeddbeb68fa3a848b7632cd634eb7b59de4d Sliver payload (encrypted): 2f8e4c5baa78f4d68cc9ac06d4bd33b4420d2d35b8168d195069a0b32c602702 Overall this was some pretty cool goop. I rarely find Linux malware that isn't some IoT bullshit. Based off of the C2 domain I am going to assume this is a smaller malware campaign, but just because it's smaller doesn't mean it's not neato goop. Pic unrelated