Symantec Troll Stealer 2024

Troll Stealer gathers information from infected systems such as SSH information from the victim's `.ssh` directory. Troll Stealer collects information from local FileZilla installations and Microsoft Sticky Note.

Gomir collects network information on infected systems such as listing interface names, MAC and IP addresses, and IPv6 addresses.

Gomir probes arbitrary network endpoints for TCP connectivity.

GoBear is installed through droppers masquerading as legitimate, signed software installers.

Troll Stealer is typically installed via a dropper file that masquerades as a legitimate security program installation file.

Gomir will configure a crontab for process execution to start the backdoor on reboot if it is not initially running under group 0 privileges.

Gomir reads command line arguments and parses them for functionality when executed from a Linux shell, and can execute arbitrary strings passed to it as shell commands.

Gomir checks the effective group ID of its process when initially executed to determine if it is in group 0, denoting superuser privileges in Linux environments.

Gomir deletes its original executable and terminates its original process after creating a systemd service.

Gomir periodically communicates to its command and control infrastructure through HTTP POST requests.

Troll Stealer can collect local system information.

Gomir collects information on infected systems such as hostname, username, CPU, and RAM information.

Gomir collects information about directory and file structures, including total number of subdirectories, total number of files, and total size of files on infected systems.

Gomir can start a reverse proxy to initiate connections to arbitrary endpoints in victim networks.

Troll Stealer can capture screenshots from victim machines.

Gomir uses Base64-encoded content in HTTP communications to command and control infrastructure.

Troll Stealer gathers information from the Government Public Key Infrastructure (GPKI) folder, associated with South Korean government public key infrastructure, on infected systems.

Troll Stealer collects information from Chromium-based browsers and Firefox such as cookies, history, downloads, and extensions.

Gomir creates a systemd service named `syslogd` for persistence.

Troll Stealer collects all data in victim `.ssh` folders by creating a compressed copy that is subsequently exfiltrated to command and control infrastructure. Troll Stealer also collects key information associated with the Government Public Key Infrastructure (GPKI) service for South Korean government information systems.

GoBear uses stolen legitimate code signing certificates for defense evasion.

Gomir uses a custom encryption algorithm for content sent to command and control infrastructure.

Gomir uses reverse proxy functionality that employs SSL to encrypt communications.