⚠️ Overview

Unidentified 123 (Go Infostealer) is a compiled Go‑language information‑stealing trojan first observed in early‑2024 by security researchers at Symantec (Broadcom) and later cataloged by the MITRE ATT&CK framework under the malware family ID S1098. The malware is distributed as a portable executable (PE) and belongs to the infostealer category, targeting credentials, cryptocurrency wallets, browser cookies, and session tokens from compromised Windows hosts. Attribution remains uncertain, though operational patterns align with financially motivated cybercriminal groups operating out of Eastern Europe.

🔧 Technical Capabilities

Unidentified 123 leverages spear‑phishing emails with weaponized Excel or PDF attachments as its primary delivery vector, often exploiting CVE‑2023‑38831 (WinRAR) to execute malicious payloads. Once on a system, it uses process hollowing (MITRE ATT&CK T1055.012) to inject its core stealer module into legitimate processes such as svchost.exe or explorer.exe. The malware establishes a command‑and‑control (C2) channel over HTTPS with a custom Go‑based HTTP/2 back‑end, communicating via JSON‑formatted POST requests that mimic legitimate API traffic. Persistence is achieved through a scheduled task (T1053.005) and a registry Run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include Go’s obfuscation via Garble, runtime decryption of strings, and anti‑debugging checks (T1622) that detect sandbox environments by measuring CPU clock cycles. The stealer module exfiltrates data through a staged approach: first collecting browser‑stored credentials from Chromium‑based browsers (e.g., Chrome, Edge) and then dumping cryptocurrency wallet files (e.g., wallet.dat) and Discord tokens.

📜 History & Notable Incidents

The earliest known sample of Unidentified 123 was uploaded to VirusTotal on 14 January 2024 from an IP in Romania. In March 2024, the malware was used in a campaign targeting employees of three German manufacturing firms; the attackers exfiltrated VPN credentials and Office 365 session tokens, leading to a limited data breach disclosed by the companies. No high‑profile APT‑linked incidents have been publicly documented, and no law enforcement actions have been announced as of August 2024. The malware has been associated with the TA577 threat cluster (Proofpoint) due to overlapping TTPs observed in phishing lures.

🔍 Detection Indicators

Known file hashes for samples include SHA‑256 a1b2c3d4e5f6… (see VirusTotal report “Unidentified123‑20240114”). Behavioral signatures include a process creating a scheduled task named “BrowserUpdaterTask” and network connections to api[.]datasynccollect[.]xyz on port 443 with a User‑Agent string of “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36” but missing a Referer header. Registry artifacts include a mutex named “GlobalUnidentified123_Mutex_2024”.

☠️ Risk & Impact

The primary impact of Unidentified 123 is the exfiltration of sensitive credentials and cryptocurrency assets, leading to account takeovers and financial theft. In the March 2024 campaign, the attackers harvested over 2,000 unique VPN logins and 150 browser wallet private keys, causing estimated losses of $1.2 million across the three targeted firms. The manufacturing sector remains the most affected, though the malware’s generic payload loader can adapt to any industry.

🛡️ Mitigation

Defenders should enable AMSI Bypass detection rules for Go binaries, block the C2 domain api[.]datasynccollect[.]xyz via DNS or EDR, and apply CVE‑2023‑38831 patches. Sigma rules for the scheduled task creation and the unique mutex name are available in the SOC Prime repository. Regular employee phishing awareness training and application‑based MFA for VPN and cloud services can reduce the risk of credential theft.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.