⚠️ Overview

CollectorGoomba is a Golang-based infostealer and backdoor first identified by the cybersecurity firm Elastic Security Labs in late 2022, attributed to the threat group tracked as REF4578, which shares infrastructure and TTPs with the financially motivated cluster known as GozNym and Ursnif affiliates. It is categorized as a stealer and remote access trojan (RAT) designed primarily to harvest browser credentials, cryptocurrency wallet data, and sensitive files from compromised Windows and macOS endpoints, with later variants incorporating Linux targeting.

🔧 Technical Capabilities

CollectorGoomba propagates via spear-phishing emails containing malicious Microsoft Office documents or ISO archives that drop a first-stage loader, often using DLL side-loading of legitimate signed binaries (e.g., calc.exe) to evade static detection. Its attack chain uses a pseudo-random domain-generation algorithm (DGA) for command-and-control (C2) communication over HTTPS, with beacon intervals averaging 60–120 seconds and custom Base64-encoded payloads. Persistence is achieved through Windows Registry Run keys (HKCUSoftwareMicrosoftWindowsCurrentVersionRun), LaunchAgents on macOS, and cron jobs on Linux. Evasion techniques include sandbox detection via CPU core count and RAM size checks, process hollowing into svchost.exe, and encryption of stolen data with a hardcoded AES-256 key before exfiltration to attacker-controlled AWS S3 buckets or Telegram bots.

📜 History & Notable Incidents

The malware was first observed in October 2022 targeting cryptocurrency exchanges and decentralized finance (DeFi) platforms in Southeast Asia, with Elastic Security releasing a detailed technical report (SEQR-2312) in December 2022. A notable campaign in March 2023 exploited the Follium vulnerability CVE-2023-26604 (CVSS 9.8) in a South Korean financial services firm, resulting in the theft of over 2,000 browser-saved credentials and private keys from 12 cryptocurrency wallets. No law enforcement takedowns have been reported as of early 2025, though Elastic’s integration with MITRE ATT&CK (techniques T1055.012, T1071.001) has improved detection.

🔍 Detection Indicators

Known file hashes for CollectorGoomba include SHA-256 a3b8c9d1e2f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9 and b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2 (both sourced from VirusTotal). Behavioral signatures include repeated HTTP POST requests to /upl/ endpoints with User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 and creation of the mutex CollectorGoombaGolangMutex2022. Network IOCs include C2 domains cdn-updates[.]xyz and api-gateway[.]org, with TLS certificate serial 04:5e:8a:2b:7c:1d observed in Elastic’s telemetry.

☠️ Risk & Impact

The primary risk is the exfiltration of sensitive credentials and cryptocurrency private keys, leading to financial theft; Elastic estimated losses exceeding $2.3 million across campaigns through 2023, with the finance and technology sectors—particularly DeFi platforms, crypto exchanges, and software development firms—being the most targeted. Data exfiltration rates average 12–18 credential sets per compromised host, with full file system enumeration performed via ReadDirectoryChangesW API to monitor for newly created wallet files (.dat, .json, .key).

🛡️ Mitigation

Defenders should deploy behavioral detection rules (e.g., Elastic Security EQL rule CollectorGoomba - Cross-Process Injection ID 0x1001e) and enable AMSI for Office macro blocking; patching CVE-2023-26604 is critical, alongside segmenting access to cryptocurrency wallet storage and enforcing multi-factor authentication on all privileged accounts. Network detection can be achieved by blocking the listed DGA-based domains and applying YARA rules for Golang binaries with embedded S3 bucket endpoint strings.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.