TF-MAL-elf.gosh
📛 Threat Title
Malware family: GOSH
Description
ThreatFox malware family `elf.gosh`. Printable name: GOSH.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
elf.gosh
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.gosh
IOC database
- Type
- domain
- Value
elf.gosh- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-elf.gosh
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.gosh
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:attack.mitre.org
SocGholish is a JavaScript-based loader malware that has been used since at least 2017. It has been observed in use against multiple sectors globally for initial access, primarily through drive-by-downloads masquerading as software updates.
-
web:cybernews.com
The FBI warns of a surge in ATM jackpotting attacks, with more than 700 incidents in 2025 alone. Hackers use Ploutus malware to force machines to dispense cash.
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the GOSH malware family including references, samples and yara signatures.
-
web:medium.com
It is linked to the Mirai malware distribution network. Execution Dialog Upon execution, the malware displayed a dialog containing the string: " gosh that chinese family at the other table sure ...
-
web:redcanary.com
SocGholish leverages drive-by-downloads masquerading as software updates to trick visitors of compromised websites into executing malware .
-
web:www.activecountermeasures.com
Used to confirm session context and privilege levels. Conclusion This " Malware of the Day" investigation into ICMP- GOSH demonstrates how adversaries adapt by misusing fundamental network protocols, like ICMP, for covert Command and Control, particularly as a means of persistence after primary access vectors are shut down.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.fbi.gov
Threat actors exploit physical and software vulnerabilities in ATMs and deploy malware to dispense cash without a legitimate transaction. The FBI has observed an increase in ATM jackpotting ...
-
web:www.huntress.com
Gopher malware is a family of malicious software, often written in the Go (Golang) programming language, designed for various cyberattacks, including data theft, espionage, and ransomware. Known for its cross-platform capabilities, Gopher can target Windows, macOS, and Linux systems, making it a versatile and persistent threat for organizations of all sizes.
-
web:www.ssh.com
Executive Summary GoScanSSH, a new strain of malware that has been targeting Linux-based SSH servers exposed to the Internet since June 2017. The malware attempts to obtain a valid SSH credential through a wordlist attack and attempts to infect the host. Upon successful login new malware is delivered infecting the host and the process is repeated. "GoScanSSH is another example of bad actors ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.