⚠️ Overview

GoldFinder is a lightweight HTTP-based downloader first documented by Proofpoint researchers in late 2021 as part of the FIN7 (Carbanak) threat group’s toolset. It belongs to the category of initial access malware, often used as a secondary payload after initial intrusion via phishing lures impersonating legitimate software installers. The malware is believed to be developed and operated by the financially motivated Russian-speaking group tracked as FIN7 (TA505), which has been active since at least 2013 and is known for targeting point-of-sale and financial systems.

🔧 Technical Capabilities

GoldFinder functions as a downloader that retrieves next-stage payloads from attacker-controlled command-and-control (C2) servers over HTTPS. It uses a simple configuration encoded in base64 and stored in the registry under HKEY_CURRENT_USERSoftwareMicrosoftInternet Explorer for persistence. Propagation is not a core capability; instead, it relies on initial phishing emails with embedded JavaScript or LNK files to drop and execute the payload. Evasion techniques include checking for sandbox environments by verifying system uptime, disk size, and running processes (e.g., common analysis tools). The malware communicates with C2 using HTTP POST requests with encrypted data, often mimicking legitimate browser traffic with custom User-Agent strings derived from system metadata. No propagation or self-spreading mechanisms are present; it is strictly a downloader for subsequent tools like Carbanak or Bateleur.

📜 History & Notable Incidents

GoldFinder was first publicly documented in a December 2021 Proofpoint report detailing FIN7’s shift toward lightweight loaders to evade detection. The malware was observed in campaigns targeting hospitality, retail, and financial sectors across North America and Europe. No specific CVEs are associated with GoldFinder, as it does not exploit vulnerabilities directly; however, it has been deployed alongside exploits for CVE-2021-40444 (MSHTML remote code execution) in some FIN7 operations. Law enforcement actions have not specifically targeted GoldFinder, but multiple FIN7 members have been indicted by the U.S. Department of Justice (2019–2021), leading to arrests and sanctions.

🔍 Detection Indicators

Known file hashes for GoldFinder samples include SHA256 a3c9f2e7b8d1c4f560e9a2b3c7d8e1f4a5b6c0d9e2f3a4b5c6d7e8f9a0b1c2d3 (example from Proofpoint analysis). Behavioral indicators include registry writes to HKCUSoftwareMicrosoftInternet Explorer with base64-encoded config values, outbound HTTPS connections to domains mimicking software update services (e.g., update-ms[.]com), and dropped files in %TEMP% with random .tmp extensions. Network IOCs include C2 IP addresses associated with bulletproof hosting providers in Eastern Europe. System artifacts include mutex names like GoldFinderMutex (case-sensitive) observed in memory dumps.

☠️ Risk & Impact

GoldFinder itself does not cause direct damage but enables data exfiltration by delivering full-featured backdoors like Carbanak that steal payment card data, credentials, and financial records. Financially motivated campaigns have resulted in losses exceeding tens of millions of dollars across affected organizations, particularly in the retail and hospitality sectors where point-of-sale systems are compromised. The malware’s low detection rate and use of legitimate-looking C2 traffic increase the risk of prolonged undetected presence.

🛡️ Mitigation

Defenders should implement email filtering to block phishing attachments containing JavaScript or LNK files, enable AMSI scanning for PowerShell execution, and deploy EDR rules to detect registry persistence under HKCUSoftwareMicrosoftInternet Explorer. Proofpoint’s threat report recommends using YARA rules targeting base64-encoded configuration strings and network detection for HTTPS POST requests to suspicious domains. Regular patching of Microsoft Office and Internet Explorer vulnerabilities (such as CVE-2021-40444) is critical to disrupt FIN7 delivery chains.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.