New Golang Trojan Installs Certificate for Comms Evasion

SonicWall researchers analyzed a new Golang 64-bit trojan that gathers system information, captures screenshots using public Go libraries, and installs a root certificate into the Windows registry to evade HTTPS detection. The sample contacts a C2 at daily-mashriq[.]org, sends chacha20-encrypted system data, and shares infrastructure overlaps with families like AgentTesla. #AgentTesla #SonicWall

Keypoints

Sample is a Golang 64-bit executable with a WinAuth certificate and a tampered timestamp (Dec 31, 1969).
Binary contains an anomalous .symtab section (ELF/Linux artifact); analyst had to reconstruct the gopcln table to reveal functions and strings.
Strings and functions indicate collection of system UUID, remote IP, username, hostname, Windows version, PID, process name, and architecture for exfiltration.
Uses public GitHub Go packages (kbinani, fogleman) to capture and save screenshots; monitors input/events with SetWindowsHookExW and TrackMouseEvent.
Performs process injection via VirtualAlloc and runs WMIC commands (e.g., ‘SELECT UUID FROM Win32_ComputerSystemProduct’) and queries registry keys for Windows/version/hostname discovery.
Contacts ip-api.com/json for IP discovery and posts data to C2 at https://daily-mashriq[.]org/goyxdrkhjilchyigflztv using chacha20 encryption and a custom User-Agent; subsequent posts send only a UID every 7 seconds.
Installs a new root certificate by overwriting a HKLM SystemCertificates ROOT registry key (using CertGetCertificateChain) to enable HTTPS communications evasion; binds several listening port ranges.

MITRE Techniques

[T1059] Command and Scripting Interpreter – The malware uses process injection via VirtualAlloc and runs WMIC commands to gather system information (‘process injection via VirtualAlloc and running WMIC’).
[T1553] Subvert Trust Controls – The trojan installs/overwrites a root certificate in the Windows registry to intercept or trust malicious HTTPS communications (‘installs a new root certificate by overriding data in the following registry key using ‘CertGetCertificateChain’’).
[T1547.001] Registry Run Keys / Startup Folder – The sample establishes persistence via registry autorun entries (article notes autorun registry behavior under persistence section).
[T1036] Masquerading – The malware renames or uses legitimate-sounding binaries and screensaver filenames to disguise components (‘masquerades by renaming legitimate programs… and uses a screensaver executable for initial infection’).
[T1574.002] DLL Side-Loading – The trojan attempts DLL sideloading by loading various DLLs and a malicious DLL alongside signed binaries (‘sideloads a malicious DLL (KeyScramblerIE.dll) using a signed binary’).
[T1003] OS Credential Dumping – The sample queries system identifiers like the UUID via WMIC to extract system-related credentials/information (‘SELECT UUID FROM Win32_ComputerSystemProduct’).
[T1016] System Network Configuration Discovery – Queries registry keys for Windows version and hostname to discover system/network configuration (‘HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersion’ and TCP/IP parameters registry queries).
[T1071] Application Layer Protocol – The malware communicates with C2 over HTTPS and uses a custom User-Agent for HTTP requests (‘communicates with its C2 server over HTTPS’ and User-Agent “AGCYRNRWWWFZZSWWFWDYDCVDN”).
[T1102] Web Service – Uses a web domain as a C2 channel (‘uses a domain (daily-mashriq[.]org) for C2 communication’).
[T1041] Exfiltration Over C2 Channel – Encoded system information is POSTed to the C2 server for exfiltration (‘encoded information sent to the C2’).
[T1022] Data Encrypted – Data sent to the C2 is encrypted with chacha20 prior to transmission (‘information encoded with chacha20 and sent using User-Agent …’).

Indicators of Compromise

[File Hash] Sample binary – 8f4cf379ee2bef6b60fec792d36895dce3929bf26d0533fbb1fdb41988df7301
[Domain/URL] C2 endpoint – https://daily-mashriq.org/goyxdrkhjilchyigflztv
[Web API] Geo/IP lookup – http://ip-api.com/json/ (used to retrieve external IP)
[Registry Key] Certificate installation target – HKEY_LOCAL_MACHINESOFTWAREMicrosoftSystemCertificatesROOTCertificates3F728A35DE52B2C8994A4FB101A03B95E87B06C8
[Network Artifact] User-Agent used for C2 posts – “AGCYRNRWWWFZZSWWFWDYDCVDN”
[Ports] Listening port ranges observed – 49708-49711, 49720-49730, 49733-49750

The analyzed sample is a Go-compiled 64-bit Windows executable signed with a WinAuth certificate and a deliberately tampered timestamp. It contains an unexpected .symtab section typical of ELF files, requiring reconstruction of the gopcln table to recover function names and strings; recovered strings reveal a patterned payload that assembles system identifiers (UUID, username, hostname, Windows version, PID, process name, architecture) destined for exfiltration.

At runtime the trojan performs process injection (VirtualAlloc) and invokes WMIC (e.g., ‘SELECT UUID FROM Win32_ComputerSystemProduct’) to collect system data, searching common paths for WMIC and related binaries. It leverages public Go libraries (kbinani to capture screenshots and fogleman to save them) and registers hooks (SetWindowsHookExW, TrackMouseEvent) to monitor user input and trigger screenshot capture; the binary also probes and attempts to load many Windows DLLs—likely for expanded post-compromise capabilities.

Network activity begins with a call to ip-api.com/json for IP discovery, followed by a ping/POST to the C2 at daily-mashriq[.]org/goyxdrkhjilchyigflztv. Initial POSTs send the patterned system data encrypted with chacha20 and use a distinctive User-Agent, then the implant sends only its UID every seven seconds. To evade TLS inspection, the malware overwrites a ROOT certificate entry in HKLM (via CertGetCertificateChain) to install a new root certificate, and it binds multiple local ports for listening to support additional communication or utilities.

SHARE THIS STORY

WhatsApp X (Twitter)Telegram Bluesky Facebook LinkedIn Threads Email Print

New Golang Trojan Installs Certificate for Comms Evasion | SonicWall