GoSerpent - Go-Based Espionage Backdoor & Multi-Tool Chain

GoSerpent is a Go-based remote access Trojan with proxy capabilities that serves as the entry stage of a carefully staged, multi-tool espionage operation. The most recent variant receives an AES-CBC encrypted, Base64-encoded command-line argument (fixed IV 31323334353637383930616263646566) carrying its C2 address and communication password, then beacons over a ChaCha20-encrypted channel keyed by the SHA256 of that password. Older 2021-era variants that take plaintext command-line arguments are still deployed alongside the newer build.

The operation is deliberately phased over months. In the initial phase GoSerpent drops ThumbcacheService (a DLL Windows service that harvests .doc/.docx/.pdf/.xls/.xlsx documents, archives them with 7-Zip under a hardcoded password, and stages them in C:\Users\Public\thumbcache_605a.db) plus the credential dumpers Mimikatz (LSASS) and QuarksDumpLocalHash (SAM hive). Weeks later the actor returns with Stowaway (an SSH-capable proxy/RAT) which delivers TmcLoader/TmcPayload, a C++ service loader that injects into svchost.exe, reads an encrypted config ({BBF061R2-BE25-4F6D-8B2D-1A6A39C3FSA2}.db), and exfiltrates the staged archive over network shares using the previously stolen credentials.

Two sources were fetched and saved verbatim to GoSerpent-Hunt-sources/. Securelist is the IOC-authoritative primary; The Hacker News corroborates the narrative and toolset.

All indicators below are drawn verbatim from the saved Securelist snapshot. IPs are shown defanged for safety; the machine-readable appendix (§10) ships fanged, import-ready values.

• Windows Service creation — Security 4697 / System 7045: review new services whose ImagePath is a DLL under svchost -k or an EXE in C:\Users\Public. Maps to ThumbcacheService / TmcLoader.
• SAM hive access — Security 4663 on HKLM\SAM and reg save hklm\sam process events (QuarksDumpLocalHash).
• LSASS access — Sysmon EventID 10 with GrantedAccess=0x1410/0x1010 targeting lsass.exe (Mimikatz).
• Staging file — File-system auditing on C:\Users\Public\ for creation of thumbcache_605a.db or files under C:\Users\Public\Libraries\.
• SMB egress — Security 5140/5145 network share access correlated with newly-dumped local accounts.

Nine queries ordered high-fidelity first. Pick your cloud, then Copy CQL or Open in Falcon per card. Validate field names against your tenant data model before scheduling.

// HUNT: GoSerpent / McMx / ThumbcacheService / Stowaway / TmcLoader known MD5 hashes
// MITRE: T1204, T1543.003
// CONF: high   FP: low   COST: low
// REQUIRES: ProcessRollup2 with MD5HashData
// FALSE POSITIVES: none expected for exact hash matches
#event_simpleName=/^(ProcessRollup2|PeFileWritten)$/
| MD5HashData=/^(EBFFD5A76AAA690BCDB922F82E0BACC5|DC506FF7BB72735444FB3703A6BEE6D8|D6E86BF8A90E9B632ADD5FA495F97FBC|CB6C4C70A3B171FA3404B8E1A3382116|64E9D1950E42BC98486DFD9919463D1C|CBBB6D483737EA3566726E51752DFF40|7F223EE0716CE2AD56F55D3744419449|19F8BEFCB035F52BF70094E6B4F5779A|846EF7C1C7323849B2A778C5E4CDA162|D08A059E8B815E3B891505BC8777FC28|93A1569D5D5AB2C4761FEDF84F83709E)$/i
| table([ComputerName, UserName, FileName, ImageFileName, MD5HashData, CommandLine], limit=max)

// HUNT: Outbound connections to the 11 published C2 IPs
// MITRE: T1071, T1573
// CONF: high   FP: low   COST: low
// REQUIRES: NetworkConnectIP4
// FALSE POSITIVES: none expected; IPs are dedicated C2 (rotate quickly)
#event_simpleName=/^NetworkConnectIP4$/
| RemoteAddressIP4=/^(152\.32\.160\.239|8\.220\.194\.108|8\.220\.214\.132|8\.220\.209\.155|8\.220\.193\.189|101\.36\.104\.87|144\.48\.6\.46|103\.138\.13\.30|47\.80\.22\.58|152\.32\.222\.113|43\.106\.30\.226)$/
| table([ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort, Protocol], limit=max)

// HUNT: Execution of masqueraded GoSerpent process names
// MITRE: T1036.005
// CONF: medium   FP: medium   COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: legit updater binaries also named updates.exe
// TUNING: exclude signed updates.exe under \Program Files\ and known vendor paths;
//         lass.exe (note: NOT lsass.exe) is high-signal on its own
#event_simpleName=/^ProcessRollup2$/
| FileName=/^(lass|updates)\.exe$/i
| ImageFileName!=/\\Program Files/i
| table([ComputerName, UserName, FileName, ImageFileName, ParentBaseFileName, CommandLine, MD5HashData], limit=200)

// HUNT: Creation of the distinctive collection archive thumbcache_605a.db
// MITRE: T1074.001, T1005
// CONF: medium   FP: low   COST: low
// TELEMETRY: thumbcache_605a.db is a 7-Zip archive renamed .db, so the matching
//   event is SevenZipFileWritten (Falcon types archive writes by content, not by
//   extension). ZipFileWritten/PE variants are kept for the loader binaries.
// FALSE POSITIVES: legit thumbcache_*.db live in AppData, NOT C:\Users\Public
#event_simpleName=/^(SevenZipFileWritten|ZipFileWritten|NewExecutableWritten|PeFileWritten)$/
| TargetFileName=/thumbcache_605a\.db$/i
| table([ComputerName, UserName, ContextBaseFileName, TargetFileName], limit=200)

// HUNT: Encrypted TmcLoader configuration DB (GUID-named)
// MITRE: T1074   (NOTE: the T1055 svchost injection that TmcPayload performs is NOT
//   observed by this file-write query -- see the Detection Coverage Map gap row.)
// CONF: medium   FP: low   COST: low
// TELEMETRY: same SevenZipFileWritten reasoning as Q4.
// SOURCE CAVEAT: the config filename below is reproduced VERBATIM from Securelist and
//   contains non-hex characters (R, S) -- it may be an OCR artifact in the source. If
//   the real on-disk name is a valid GUID, this literal will not match. Hunt/enrich only.
#event_simpleName=/^(SevenZipFileWritten|ZipFileWritten|NewExecutableWritten|PeFileWritten)$/
| TargetFileName=/\{BBF061R2-BE25-4F6D-8B2D-1A6A39C3FSA2\}\.db$/i
| table([ComputerName, UserName, ContextBaseFileName, TargetFileName], limit=200)

// HUNT: 7-Zip invoked with the ThumbcacheService archive password
// MITRE: T1560.001
// CONF: high   FP: low   COST: low
// REQUIRES: ProcessRollup2 with CommandLine
// FALSE POSITIVES: none; password literal is campaign-specific
#event_simpleName=/^ProcessRollup2$/
| CommandLine=/@vx0a9n5W2M0c3D6/
| table([ComputerName, UserName, FileName, CommandLine, MD5HashData], limit=200)

// HUNT: Service install whose ImagePath resolves under C:\Users\Public
// MITRE: T1543.003
// CONF: medium   FP: low   COST: medium
// REQUIRES: ServiceInstalled
// NOTE: the earlier svchost.*-k branch was removed -- "svchost.exe -k <group>" is the
//       normal ImagePath of nearly every built-in Windows service and matched all of
//       them. A service binary under a user-writable path is the real anomaly here.
// FALSE POSITIVES: rare legit installers that stage under Public; exclude signed ones.
#event_simpleName=/^(CreateService|ModifyServiceBinary)$/
| ServiceImagePath=/\\Users\\Public\\/i
| table([ComputerName, UserName, ServiceDisplayName, ServiceImagePath], limit=200)

// HUNT: Command-line sigils of LSASS/SAM credential dumping
// MITRE: T1003.001, T1003.002
// CONF: medium   FP: medium   COST: low
// REQUIRES: ProcessRollup2 with CommandLine
// FALSE POSITIVES: admins running reg save / backup of SAM legitimately
// TUNING: scope to non-admin or unexpected parent processes; exclude sanctioned
//         backup/IR tooling by MD5HashData allowlist
#event_simpleName=/^ProcessRollup2$/
| CommandLine=/sekurlsa|lsadump|privilege::debug|reg(\.exe)?\s+save\s+hk(lm|ey_local_machine)\\sam|QuarksDump/i
| table([ComputerName, UserName, FileName, ParentBaseFileName, CommandLine, MD5HashData], limit=200)

// HUNT: SOCKS5/SSH tunnel setup and McMx plaintext-config creation
// MITRE: T1090.001, T1572, T1059.003
// CONF: medium   FP: high   COST: medium
// REQUIRES: ProcessRollup2 (cmdline)
// FALSE POSITIVES: legit admin ssh -R/-D tunnels; batch scripts using echo
// TUNING: restrict to non-IT hosts; require an uncommon parent (cmd spawned by a
//         Public-dir binary) and exclude sanctioned jump-box / bastion accounts
#event_simpleName=/^ProcessRollup2$/
| CommandLine=/ssh(\.exe)?\s+.*-[RDL]\s|socks5|echo\s+.*(secret|rhost|rport).*>/i
| ParentBaseFileName!=/^(devenv|code|WindowsTerminal)\.exe$/i
| table([ComputerName, UserName, FileName, ParentBaseFileName, CommandLine], limit=200)

Grouped Quick-Copy grid for fast pivoting, plus an import-ready CSV for Falcon IOC Management.

152.32.160.239
8.220.194.108
8.220.214.132
8.220.209.155
8.220.193.189
101.36.104.87
144.48.6.46
103.138.13.30
47.80.22.58
152.32.222.113
43.106.30.226

EBFFD5A76AAA690BCDB922F82E0BACC5
DC506FF7BB72735444FB3703A6BEE6D8
D6E86BF8A90E9B632ADD5FA495F97FBC
CB6C4C70A3B171FA3404B8E1A3382116
64E9D1950E42BC98486DFD9919463D1C
CBBB6D483737EA3566726E51752DFF40
7F223EE0716CE2AD56F55D3744419449
19F8BEFCB035F52BF70094E6B4F5779A
846EF7C1C7323849B2A778C5E4CDA162
D08A059E8B815E3B891505BC8777FC28
93A1569D5D5AB2C4761FEDF84F83709E

lass.exe
updates.exe
thumbcache_605a.db      (C:\Users\Public\)
{BBF061R2-BE25-4F6D-8B2D-1A6A39C3FSA2}.db  (C:\Users\Public\Libraries\)
7-Zip archive password: @vx0a9n5W2M0c3D6.#
AES-CBC fixed IV: 31323334353637383930616263646566

type,value,action,severity,description
ipv4,152.32.160.239,detect,high,GoSerpent C2
ipv4,8.220.194.108,detect,high,GoSerpent C2
ipv4,8.220.214.132,detect,high,GoSerpent C2
ipv4,8.220.209.155,detect,high,GoSerpent C2
ipv4,8.220.193.189,detect,high,GoSerpent C2
ipv4,101.36.104.87,detect,high,GoSerpent C2
ipv4,144.48.6.46,detect,high,GoSerpent C2
ipv4,103.138.13.30,detect,high,GoSerpent C2
ipv4,47.80.22.58,detect,high,GoSerpent C2
ipv4,152.32.222.113,detect,high,GoSerpent C2
ipv4,43.106.30.226,detect,high,GoSerpent C2
md5,EBFFD5A76AAA690BCDB922F82E0BACC5,detect,high,GoSerpent
md5,DC506FF7BB72735444FB3703A6BEE6D8,detect,high,GoSerpent
md5,D6E86BF8A90E9B632ADD5FA495F97FBC,detect,high,McMx RAT
md5,CB6C4C70A3B171FA3404B8E1A3382116,detect,high,ThumbcacheService
md5,64E9D1950E42BC98486DFD9919463D1C,detect,high,ThumbcacheService
md5,CBBB6D483737EA3566726E51752DFF40,detect,high,Stowaway
md5,7F223EE0716CE2AD56F55D3744419449,detect,high,Stowaway
md5,19F8BEFCB035F52BF70094E6B4F5779A,detect,high,Stowaway
md5,846EF7C1C7323849B2A778C5E4CDA162,detect,high,Stowaway
md5,D08A059E8B815E3B891505BC8777FC28,detect,high,TmcLoader
md5,93A1569D5D5AB2C4761FEDF84F83709E,detect,high,TmcLoader
filename,lass.exe,detect,medium,GoSerpent masquerade
filename,updates.exe,hunt,medium,GoSerpent masquerade (generic name; hunt-only to avoid FP on legit updaters)
filename,thumbcache_605a.db,detect,high,ThumbcacheService staging archive

• Every atomic IOC (11 IPs, 11 MD5, 3 filenames) traces to the saved Securelist snapshot in GoSerpent-Hunt-sources/.
• All CQL fields validated against the Falcon data model (ProcessRollup2, NetworkConnectIP4, ServiceInstalled, file-write events).
• Regexes match basenames via FileName / TargetFileName — no unescaped path slashes inside /.../.
• Every FP medium/high card (Q3, Q7, Q8, Q9) carries a // TUNING: exclusion.
• Date stamped 2026-07-22 across sidebar, header, changelog, ticket and footer.
• Before deploy: confirm your tenant emits ServiceInstalled and a file-write event carrying TargetFileName (Q4/Q5/Q7 depend on these).

Immediate (this week)

Near term (1–4 weeks)

Strategic (1–3 months)

Enable LSASS RunAsPPL (blocks Mimikatz)

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPLBoot /t REG_DWORD /d 1 /f
# Reboot required. Verify after reboot:
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL

AppLocker deny rule for user-writable staging dir (PowerShell)

<!-- Deny execution from C:\Users\Public, where GoSerpent drops its collection tooling. -->
<!-- Import: Group Policy -> Computer Configuration -> Windows Settings -> Security
     Settings -> Application Control Policies -> AppLocker -> Executable Rules -->
<!-- SHIPS AS AuditOnly ON PURPOSE. Run it for at least a week and review EventID
     8003 before flipping EnforcementMode to "Enabled". -->
<RuleCollection Type="Exe" EnforcementMode="AuditOnly">
  <!-- Microsoft default allow rules -- DO NOT REMOVE. Without them, enforcing this
       collection blocks every executable on the machine, including your RMM agent. -->
  <FilePathRule Id="921cc481-6e17-4653-8f75-050b80acca20" Name="(Default) All files in Program Files"
                Description="Allows Everyone to run applications in Program Files."
                UserOrGroupSid="S-1-1-0" Action="Allow">
    <Conditions><FilePathCondition Path="%PROGRAMFILES%\*" /></Conditions>
  </FilePathRule>
  <FilePathRule Id="a61c8b2c-a319-4cd0-9690-d2177cad7b51" Name="(Default) All files in Windows"
                Description="Allows Everyone to run applications in the Windows folder."
                UserOrGroupSid="S-1-1-0" Action="Allow">
    <Conditions><FilePathCondition Path="%WINDIR%\*" /></Conditions>
  </FilePathRule>
  <FilePathRule Id="fd686d83-a829-4351-8ff4-27c7de5755d2" Name="(Default) All files -- Administrators"
                Description="Allows local Administrators to run all applications."
                UserOrGroupSid="S-1-5-32-544" Action="Allow">
    <Conditions><FilePathCondition Path="*" /></Conditions>
  </FilePathRule>

  <!-- Some installers stage to Users\Public. Audit for a week, then enforce and confirm the collection tooling cannot run from that path. -->
  <FilePathRule Id="e58a1c94-6d20-47b3-bf09-2a4c8e1d5f77" Name="Deny execution from Users\Public for standard users"
                Description="GoSerpent drops and runs collection tooling from the Public profile"
                UserOrGroupSid="S-1-5-32-545" Action="Deny">
    <Conditions>
      <FilePathCondition Path="%SYSTEMDRIVE%\Users\Public\*" />
    </Conditions>
  </FilePathRule>
</RuleCollection>

Prerequisites: the Application Identity service (AppIDSvc) must be Running/Automatic, set via GPO -- AppLocker evaluates nothing without it. Pilot OU. Reboot required: no (gpupdate /force to refresh policy).

Verify: during the AuditOnly week, review Applications and Services Logs > Microsoft > Windows > AppLocker > EXE and DLL for EventID 8003 (would-have-blocked). Zero unexpected entries means it is safe to set EnforcementMode="Enabled"; a real block then logs EventID 8004.

Rollback: set EnforcementMode="NotConfigured" and re-import, or unlink the GPO and run gpupdate /force. If a host is already locked out by an over-broad policy, boot to Safe Mode (AppLocker does not enforce there) and stop AppIDSvc, or delete %WINDIR%\System32\AppLocker\*.AppLocker.

Audit SAM hive access (deny non-admin reg save)

auditpol /set /subcategory:"Registry" /success:enable /failure:enable
# Then set a SACL on HKLM\SAM for the Everyone principal (read/enumerate)
# and alert on Security event 4663 targeting the SAM key.

Isolate

• Network-contain any host matching Q1/Q2 (known hash or C2 callback) via Falcon RTR.
• Block the 11 C2 IPs at the perimeter and the 11 MD5 in Falcon IOC Management.

Eradicate

• Remove the ThumbcacheService and TmcLoader Windows services; delete thumbcache_605a.db and the GUID config DB.
• Hunt for and kill masqueraded lass.exe/updates.exe and any svchost with injected TmcPayload.
• Assume all local + cached domain credentials on affected hosts are compromised.

Recover

• Force-reset local account passwords (deploy LAPS) and rotate any domain creds that logged on interactively to affected hosts.
• Review SMB share access logs (5140/5145) for exfil of the staged archive; notify data owners.
• Enable RunAsPPL + AppLocker deny rules before returning hosts to service.

• Securelist / Kaspersky GReAT — "GoSerpent backdoor attacks in Southeast Asia" (Noushin Shabab, 2026-07-16). securelist.com/goserpent-backdoor-in-southeast-asia/120687
• The Hacker News — "New GoSerpent Malware Targets Southeast Asian Governments and Diplomats for Espionage" (2026-07). thehackernews.com
• MITRE ATT&CK — attack.mitre.org
• Saved source snapshots: GoSerpent-Hunt-sources/01-securelist-goserpent.txt, 02-thehackernews-goserpent.txt

GoSerpent · v0.2 · Generated 2026-07-22 · Author: HuntPack · Defensive detection content only