MalwareUsed by 1 actor

Arid Gopher

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Arid Viper

Deep Instinct named the Go-written malware Arid Gopher... it became clear the team were looking at a variant of Micropsia.

via register securitytheregister.com

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1585.001Social Media AccountsEvidence1

The group is known for employing spear-phishing emails and fake social media profiles to lure targets into installing malware on their devices.

Initial Access

2 techniques

T1566PhishingEvidence1

The group is known for employing spear-phishing emails and fake social media profiles to lure targets into installing malware on their devices.

T1566.001Spearphishing AttachmentEvidence1

The variants are emailed to targets in .xz RAR archives, and unpack with a long filename to hopefully push their .exe extension out of sight.

Execution

1 technique

T1053.005Scheduled TaskEvidence1

The last malicious activity occurred from January 12 onwards when Arid Gopher was used to execute the unknown file named localsecuritypolicy.exe every ten hours.

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

The last malicious activity occurred from January 12 onwards when Arid Gopher was used to execute the unknown file named localsecuritypolicy.exe every ten hours.

T1547.001Registry Run Keys / Startup FolderEvidence1

Arid Gopher was in turn used to run a tool called SetRegRunKey.exe that provided persistence by adding Arid Gopher to the registry so that it executed on reboot.

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

The last malicious activity occurred from January 12 onwards when Arid Gopher was used to execute the unknown file named localsecuritypolicy.exe every ten hours.

T1547.001Registry Run Keys / Startup FolderEvidence1

Arid Gopher was in turn used to run a tool called SetRegRunKey.exe that provided persistence by adding Arid Gopher to the registry so that it executed on reboot.

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

Three distinct sets of obfuscated PowerShell commands were executed to load a Base64-encoded string, which started embedded shellcode.

T1036MasqueradingEvidence1

The variants are emailed to targets in .xz RAR archives, and unpack with a long filename to hopefully push their .exe extension out of sight.

T1036.006Space after FilenameEvidence1

and drop a decoy document on the desktop and display it so that the victim thinks they've simply saved and opened an attached Word file and not malware.

Collection

1 technique

T1560Archive Collected DataEvidence1

On December 21, RAR was executed to archive files on another infected computer.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

When uploading each file, the tools sends an HTTP POST request to a C&C server...

T1105Ingress Tool TransferEvidence2

our investigation revealed a 'helper' malware, also written in Go, and a second-stage malware which was downloaded from the C2 [command-and-control] server.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

This was immediately followed by the exfiltration of a RAR file...

INDICATORS OF COMPROMISE

IOCs tracked for this family

9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Other

5 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 years ago

ip.v4●●●●●●●●●●●●View more in app3 years ago

uri●●●●●●●●●●●●View more in app3 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

malpediaNews

Dec 14, 2023

AridViper (Threat Actor)

Arid Gopher is described as a new malware variant/tool used in attacks against Palestinian targets and analyzed as part of Arid Viper activity.

symantec enterprise blogsNews

Apr 4, 2023

Mantis: New Tooling Used in Attacks Against Palestinian Targets | SECURITY.COM

A custom Go-based backdoor used by Mantis/Arid Viper for persistence, command-and-control, downloading and executing additional payloads, and launching helper tools and unknown executables. It embeds legitimate utilities and a helper component to establish Run-key persistence, and appears to be frequently rewritten to evade detection.

Mar 22, 2022

What does malware written in Go look like? A sample analyzed

A Go-written variant of the Arid Viper malware family used to infect Windows systems, open a backdoor to a command-and-control server, receive further instructions, and drop/display decoy documents to disguise the infection.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching9

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

Arid Gopher

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Arid Viper

Deep Instinct named the Go-written malware Arid Gopher... it became clear the team were looking at a variant of Micropsia.

via register securitytheregister.com

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1585.001Social Media AccountsEvidence1

The group is known for employing spear-phishing emails and fake social media profiles to lure targets into installing malware on their devices.

Initial Access

2 techniques

T1566PhishingEvidence1

The group is known for employing spear-phishing emails and fake social media profiles to lure targets into installing malware on their devices.

T1566.001Spearphishing AttachmentEvidence1

The variants are emailed to targets in .xz RAR archives, and unpack with a long filename to hopefully push their .exe extension out of sight.

Execution

1 technique

T1053.005Scheduled TaskEvidence1

The last malicious activity occurred from January 12 onwards when Arid Gopher was used to execute the unknown file named localsecuritypolicy.exe every ten hours.

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

The last malicious activity occurred from January 12 onwards when Arid Gopher was used to execute the unknown file named localsecuritypolicy.exe every ten hours.

T1547.001Registry Run Keys / Startup FolderEvidence1

Arid Gopher was in turn used to run a tool called SetRegRunKey.exe that provided persistence by adding Arid Gopher to the registry so that it executed on reboot.

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

The last malicious activity occurred from January 12 onwards when Arid Gopher was used to execute the unknown file named localsecuritypolicy.exe every ten hours.

T1547.001Registry Run Keys / Startup FolderEvidence1

Arid Gopher was in turn used to run a tool called SetRegRunKey.exe that provided persistence by adding Arid Gopher to the registry so that it executed on reboot.

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

Three distinct sets of obfuscated PowerShell commands were executed to load a Base64-encoded string, which started embedded shellcode.

T1036MasqueradingEvidence1

The variants are emailed to targets in .xz RAR archives, and unpack with a long filename to hopefully push their .exe extension out of sight.

T1036.006Space after FilenameEvidence1

and drop a decoy document on the desktop and display it so that the victim thinks they've simply saved and opened an attached Word file and not malware.

Collection

1 technique

T1560Archive Collected DataEvidence1

On December 21, RAR was executed to archive files on another infected computer.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

When uploading each file, the tools sends an HTTP POST request to a C&C server...

T1105Ingress Tool TransferEvidence2

our investigation revealed a 'helper' malware, also written in Go, and a second-stage malware which was downloaded from the C2 [command-and-control] server.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

This was immediately followed by the exfiltration of a RAR file...

INDICATORS OF COMPROMISE

IOCs tracked for this family

9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Other

5 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 years ago

ip.v4●●●●●●●●●●●●View more in app3 years ago

uri●●●●●●●●●●●●View more in app3 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

malpediaNews

Dec 14, 2023

AridViper (Threat Actor)

Arid Gopher is described as a new malware variant/tool used in attacks against Palestinian targets and analyzed as part of Arid Viper activity.

symantec enterprise blogsNews

Apr 4, 2023

Mantis: New Tooling Used in Attacks Against Palestinian Targets | SECURITY.COM

Mar 22, 2022

What does malware written in Go look like? A sample analyzed

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching9

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.