Garble

Reported Context (4)

The same backdoor, but written in Golang and compiled for Linux. It is additionally obfuscated with Garble and was observed on systems under the name time. This version is functionally similar, but instead of executing APT31 Targeted Russian IT Firms With New Malware and Cloud-Based C2
via the SSH protocol. Depending on settings, it can operate over TCP or UDP. The tool is obfuscated with garble, so some function names are missing and most libraries and types are renamed. Researchers Detail Goffee’s Malware and Stealthy Attacks on Russian Organizations
Furthermore, a significant portion of samples encountered by Volexity have been obfuscated by Garble or other such tools. Volexity Adds Go String and Runtime Type Analysis to Its Golang Tools
are retrieved from PhantomCore data.Some PhantomCore variants are obfuscated with the Golang obfuscator, garble, which makes them more challenging for the analyst, but the core functionality is similar — to connect to MacroPack-Generated Office Documents Deliver Havoc, Brute Ratel and PhantomCore Payloads

CVE (2)

Malware (18)

People (6)

Threat Actors (4)

MITRE ATT&CK (60)

Vendors (5)

Products (26)

Tools (31)

Industries (4)

Countries (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.