Procedure examples

GoldMax has used decoy traffic to surround its malicious network traffic to avoid detection.

GoldMax retrieved a list of the system's network interface after execution.

GoldMax has been packed for obfuscation.

GoldMax has written AES-encrypted and Base64-encoded configuration files to disk.

GoldMax has impersonated systems management software to avoid detection.

GoldMax has used filenames that matched the system name, and appeared as a scheduled task impersonating systems management software within the corresponding ProgramData subfolder.

GoldMax can exfiltrate files over the existing C2 channel.

The GoldMax Linux variant has used a crontab entry with a @reboot line to gain persistence.

GoldMax has used scheduled tasks to maintain persistence.

GoldMax can spawn a command shell, and execute native commands.

GoldMax has used HTTPS and HTTP GET requests with custom HTTP cookies for C2.

GoldMax can download and execute additional files.

GoldMax can check the current date-time value of the compromised system, comparing it to the hardcoded execution trigger and can send the current timestamp to the C2 server.

GoldMax has decoded and decrypted the configuration file when executed.

GoldMax will check if it is being run in a virtualized environment by comparing the collected MAC address to c8:27:cc:c2:37:5a.

GoldMax has set an execution trigger date and time, stored as an ASCII Unix/Epoch time value.

The GoldMax Linux variant has been executed with the `nohup` command to ignore hangup signals and continue to run if the terminal session was terminated.

GoldMax has RSA-encrypted its communication with the C2 server.