The blog post on GoldenJackal’s two separate toolsets for breaching air-gapped systems is available on WeLiveSecurity at https://www.welivesecurity.com/en/eset-research/mind-air-gap-goldenjackal-gooses-government-guardrails.
| SHA-1 | Filename | Detection | Description |
|---|---|---|---|
|
|
Win32/Agent.AGKQ |
GoldenDealer |
|
|
Python/Agent.ANA |
GoldenHowl |
|
|
WinGo/Agent.AAO |
GoldenRobo |
|
|
WinGo/DataStealer.A |
GoldenUsbCopy |
|
|
WinGo/Spy.Agent.AH |
GoldenUsbGo |
|
|
WinGo/DataStealer.C |
GoldenAce |
|
|
MSIL/Agent.WPJ |
JackalWorm - simpler version |
|
|
WinGo/Spy.Agent.CA |
GoldenBlacklist |
|
|
Python/TrojanDownloader.Agent.YO |
GoldenPyBlacklist |
|
|
Python/Agent.ALE |
GoldenMailer |
|
|
WinGo/Agent.YH |
GoldenDrive |
|
|
Python/Agent.ALF |
Python HTTP server |
| IP | Domain | Hosting provider | First seen | Details |
|---|---|---|---|---|
83.24.9[.]124 |
N/A |
OPL - Hostmaster, ORG-PT1-RIPE |
2019-08-09 |
Primary C&C server used by GoldenJackal in 2019. |
196.29.32[.]210 |
N/A |
Charles Mashamba |
2019-08-09 |
Secondary C&C server used by GoldenJackal in 2019. |
N/A |
assistance[.]uz |
N/A |
2019-09-25 |
Compromised website used to download malware. |
N/A |
thehistore[.]com |
N/A |
2019-09-25 |
Compromised website used as C&C server. |
N/A |
xgraphic[.]ro |
N/A |
2019-09-25 |
Compromised website used as C&C server. |