GopherWhisper APT: Detecting Go-Based Loaders and Injectors in Government Networks

---
title: GopherWhisper - Suspicious Unsigned Go Binary Execution
id: 8a4b2c1d-5e6f-4a3b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects the execution of unsigned binaries compiled with Go, often indicative of GopherWhisper tooling. Looks for processes lacking company signatures or exhibiting Go build artifacts.
references:
  - https://www.welivesecurity.com/2026/04/06/gopherwhisper-apt-mongolia/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '.exe'
    Company|contains:
      - '' # Detects empty Company fields common in custom malware
  filter_legit_go:
    Image|contains:
      - '\Program Files\'
      - '\Program Files (x86)\'
    Signed: true
  condition: selection and not filter_legit_go
falsepositives:
  - Legitimate administrative tools written in Go
level: high
---
title: GopherWhisper - Process Injection via Windows API Calls
id: 9b5c3d2e-6f7a-5b4c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects suspicious API call sequences often used by custom injectors to deploy unauthorized access mechanisms.
references:
  - https://attack.mitre.org/techniques/T1055/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1055
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'VirtualAllocEx'
      - 'WriteProcessMemory'
      - 'CreateRemoteThread'
  condition: selection
falsepositives:
  - Legitimate debugging tools (rare in user context)
level: high
---
title: GopherWhisper - Suspicious Loader in User Directory
id: 0c6d4e3f-7a8b-6c5d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects execution of binaries from User Profile directories (Downloads, AppData) characteristic of dropper/loader activity.
references:
  - https://attack.mitre.org/techniques/T1547/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1566
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - '\Users\'
      - '\AppData\Local\Temp\'
      - '\Downloads\'
    Image|endswith:
      - '.exe'
  condition: selection
falsepositives:
  - Software installers run by users
level: medium

let SuspiciousParents = dynamic(["winword.exe", "excel.exe", "powerpnt.exe", "msedge.exe", "chrome.exe"]);
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ (SuspiciousParents)
// Filter for executables
| where FileName endswith ".exe"
// Check for unsigned or suspicious files
| where IsSigned == false or SigningStatus != "Valid"
// Golang binaries often have high entropy and are large; this looks for anomalies in file size logic or just flag the unsigned activity
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, InitiatingProcessFileName, SHA256, FileSize
| order by Timestamp desc

-- Hunt for processes with suspicious characteristics consistent with Go-based malware
SELECT Pid, Name, Exe, CommandLine, Username, StartTime
FROM pslist()
-- Filter for unsigned binaries running from user directories
WHERE Exe =~ 'C:\\Users\\.*\\AppData\\.*\\.*.exe'
   OR Exe =~ 'C:\\Users\\.*\\Downloads\\.*.exe'
-- Exclude known legitimate paths to reduce noise (adjust based on environment)
AND NOT Exe =~ 'C:\\Program Files\\.*'
AND NOT Exe =~ 'C:\\Windows\\System32\\.*'

<#
    .SYNOPSIS
    Hunt for GopherWhisper Indicators of Compromise
    .DESCRIPTION
    Scans user directories for unsigned executables created in the last 30 days.
#>

$DateThreshold = (Get-Date).AddDays(-30)
$PathsToScan = @("C:\Users\", "C:\ProgramData\")

Write-Host "[+] Scanning for unsigned executables modified after $DateThreshold..." -ForegroundColor Cyan

foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -Include *.exe -ErrorAction SilentlyContinue | 
        Where-Object { $_.LastWriteTime -gt $DateThreshold } | 
        ForEach-Object {
            $FilePath = $_.FullName
            # Check Signature
            $Signature = Get-AuthenticodeSignature -FilePath $FilePath
            
            # GopherWhisper tools are typically unsigned or invalidly signed
            if ($Signature.Status -ne "Valid") {
                # Check Version Info for Go hints (sometimes present)
                try {
                    $VersionInfo = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($FilePath)
                    if ($VersionInfo.CompanyName -eq "" -or $VersionInfo.OriginalFilename -like "*go*" -or $VersionInfo.FileDescription -eq "") {
                        Write-Host "[!] Suspicious unsigned file found: $FilePath" -ForegroundColor Red
                        Write-Host "    - Size: $($_.Length) bytes"
                        Write-Host "    - Modified: $($_.LastWriteTime)"
                    }
                } catch {
                    # Ignore errors reading version info
                }
            }
        }
    }
}