TF-MAL-elf.gomir
📛 Threat Title
Malware family: Gomir
Description
ThreatFox malware family `elf.gomir`. Printable name: Gomir.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
elf.gomir
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.gomir
IOC database
- Type
- domain
- Value
elf.gomir- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-elf.gomir
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.gomir
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (8)
-
web:advisory.eventussecurity.com
This malware is attributed to the North Korean Springtail espionage group, also known as Kimsuky. Linked to recent campaigns targeting organizations in South Korea, Linux. Gomir shares structural similarities with the GoBear backdoor, previously utilized by Springtail in Windows environments.
-
web:attack.mitre.org
Gomir Gomir is a Linux backdoor variant of the Go-based malware GoBear, uniquely assoicated with Kimsuky operations. [1]
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the Gomir malware family including references, samples and yara signatures.
-
web:securityaffairs.com
Symantec researchers observed the North Korea-linked group Kimsuky using a new Linux backdoor dubbed Gomir . The malware is a version of the GoBear backdoor which was delivered in a recent campaign by Kimsuky via Trojanized software installation packages.
-
web:socprime.com
Heads up! The nefarious cyber-espionage group Kimsuky APT, aka Springtail, enriches its offensive toolkit with a novel malware variant dubbed Linux. Gomir . The novel backdoor, which is considered to be a Linux iteration of the GoBear malware , is leveraged by adversaries in the ongoing cyber attacks against South Korean organizations.
-
web:thehackernews.com
The Kimsuky (aka Springtail) advanced persistent threat (APT) group, which is linked to North Korea's Reconnaissance General Bureau (RGB), has been observed deploying a Linux version of its GoBear backdoor as part of a campaign targeting South Korean organizations. The backdoor, codenamed Gomir , is "structurally almost identical to GoBear, with extensive sharing of code between malware ...
-
web:thenimblenerd.com
North Korea's Kimsuki group has unleashed the Gomir malware , a menacing Linux variant of the GoBear backdoor, through compromised software installers. This escalation in cyber-espionage activities, targeting South Korean systems, underscores the extensive threat posed by these state-sponsored hackers.
-
web:www.security.com
The dropper was signed with what appeared to be a stolen certificate. Gomir backdoor Symantec's investigation into the attacks uncovered a Linux version of this malware family (Linux. Gomir ) which is structurally almost identical and shares an extensive amount of distinct code with the Windows Go-based backdoor GoBear.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.