# LongNosedGoblin: The cyber espionage ghost quietly infiltrates the governments of Japan and Southeast Asia. ## **Overview** No need for 0-day exploits, no noise, and not leaving many unusual traces on the system. However, **LongNosedGoblin**—a newly discovered APT group—is quietly infiltrating the networks of government agencies in Southeast Asia and Japan using legitimate administrative tools. Behind this "normal operation" facade is a targeted cyber-espionage campaign lasting several months, aimed at gathering sensitive information and maintaining long-term control within the victim's system. This group uses a diverse set of custom tools, primarily consisting of C#/.NET applications, and notably uses Group Policy to deploy malware and move laterally across the target's system. This article will detail **LongNosedGoblin and how users can protect themselves.** ## **Overview of LongNosedGoblin** **LongNosedGoblin** is a new **APT (Advanced Persistent Threat)** group discovered by **ESET** researchers in 2023. They specialize in conducting **targeted cyber espionage campaigns** aimed at **government agencies and state organizations in Southeast Asia and Japan**. This group is considered highly organized, operates discreetly, and shows many characteristics suggesting **links to attack groups originating from China**. As mentioned above, unlike many APT campaigns that focus on exploiting zero-day vulnerabilities or launching massive attacks, **LongNosedGoblin** opts for a **quiet but persistent** approach. The group leverages **legitimate system administration tools**, particularly **Windows Group Policy in Active Directory environments**, to distribute malware widely, thereby avoiding detection by traditional defense mechanisms. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766453776578/de008b65-a111-4f1a-a217-08aec3caa96d.png align="center") ### **Group Activity History** **Phase One: Stealthy Infiltration (2023)** * Some of the earliest activities of **LongNosedGoblin** were detected in the **internal networks of several government organizations in Southeast Asia**. During this phase, the group mainly focused on: * Maintaining internal access after the initial breach; * Testing and refining data collection tools; * Using **Group Policy** to deploy payloads without drawing attention. **Phase Two: Expansion and Tool Refinement (2024)** * In **2024**, LongNosedGoblin began to **expand its operations**, with more clearly documented campaigns in: * Several Southeast Asian countries. * Some government organizations and related entities in **Japan**. * This phase saw the group perfect its unique malware toolkit, including: * **NosyHistorian** – a tool for collecting browsing history to categorize victims; * **NosyDoor** – a remote control backdoor using legitimate cloud services as a C&C channel; * Supporting modules like stealers, keyloggers, and reverse proxies. **Phase of Persistent Activity and Links to Other Groups (Late 2024 – 2025)** * From **late 2024 to 2025**, ESET continued to record new variants of LongNosedGoblin malware, indicating: * The group still **maintains long-term access** in some compromised systems; * Tooling is updated to evade detection signatures; * There are components with **similarities to tools from other China-related APT groups**, though distinct enough to be considered a separate group. ### **Group Objectives** * Collect browser history to profile victims (NosyHistorian) * Deploy backdoor for long-term espionage (NosyDoor) * Steal browser data and credentials (NosyStealer) * Keylogging and screen/audio capture * Lateral movement through Group Policy ### **Toolset & Methods** * C#/.NET application with the internal name "GetBrowserHistory" * Deployed via Group Policy with the filename History.ini (disguised as an INI file) * Collects browser history from Chrome, Edge, Firefox for all users * Uploads to an internal SMB share within the compromised network * Attacker uses the data to decide which victim will have the backdoor deployed * PDB path: E:\\Csharp\\SharpMisc\\GetBrowserHistory\\obj\\Debug\\GetBrowserHistory.pdb ## **Nature of GachiLoader** GachiLoader is **not the final payload**, but a **multi-stage loader** with the main tasks of: * Avoiding analysis. * Gathering environmental information. * Deciding whether to continue the attack. * Loading the next-stage payload (infostealer). ## **Technical Analysis** First, as is known, **GachiLoader** is a heavily obfuscated Node.js JavaScript malware used to deploy additional payloads to infected machines. Analysts have developed a tool to monitor suspicious behavior in `Node.js` scripts. * [GitHub - CheckPointSW/Nodejs-Tracer](https://github.com/CheckPointSW/Nodejs-Tracer) ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766539816274/e937fc3c-8801-4e86-8a6b-e01b235f8359.png align="center") As mentioned above, **GachiLoader** uses highly effective **Anti-Analysis** techniques. This can be considered a core component of this malware. To evade cybersecurity experts and Sandbox environments, **the GachiLoader JavaScript modules** use several anti-VM and anti-analysis checks: * Check if the total RAM is at least 4GB. * Check if there are at least 2 CPU cores. * Compare the username with a list of usernames associated with Sandbox environments. * Check the hostname against a similar list. * Probe running programs and compare them with a list of programs, such as analysis tools. Not stopping there, **GachiLoader** continues to run several PowerShell commands to check: * Count the number of physical port connectors: `(Get-WmiObject Win32_PortConnector).Count` * Query WMI to get the system's physical drive model name and compare it with a blacklist: `Get-WmiObject Win32_DiskDrive | Select-Object -ExpandProperty Model` ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766544532019/58d5cc97-57ab-497e-b405-938efc14f638.png align="center") In addition, to avoid detection of subsequent payloads, this malware will continue to kill the `SecHealthUI.exe` processes of **Windows Defender** by running `taskkill /F /IM SecHealthUI.exe` and add exclusion options to **Defender through Add-MpPreference -ExclusionPath for the following paths:** * `C:\Users\` * `C:\ProgramData\` * `C:\Windows\` Like other basic malware, the nature of **GachiLoader** involves a software distribution phase, or in other words, luring users. Here, the hacker group **LongNosedGoblin** creates fake YouTube videos such as: **Game cheats, software cracks, or hacking tools...** Of course, these guides always include disabling **Windows Defender.** This can be seen as the technique: **“T1204.002 – User Execution“ - Getting users to execute malware themselves.** After distribution, the malware's `.exe` files are executed. These files are large (60-90MB) and are built using **nexe:** * Bundles the Node.js runtime * No need to install Node on the victim's machine ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766546644446/8e756363-0b28-4552-bfab-a17d1d62a6b5.png align="center") After gaining anti-analysis capabilities as mentioned above, this malware will establish connections with the C2 to download additional necessary payloads. To communicate with the C2, the malware will use the POST method and send log requests to the C2: `62[.]60[.]226[.]233` or `66[.]63[.]187[.]72`. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766547276484/2f56d3e0-0e93-48e9-9e89-55e97f474113.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766547298510/467a93f7-070b-42cd-b357-07f027977aaa.png align="center") Some initial data will be sent, including: * OS version * Architecture * Installed AV * Username * Hostname * Privilege level * Runtime info Right after this process, the **LongNosedGoblin** group continues to deploy additional variants of **GachiLoader**, including two main payloads: Remote Payload and Kidkadi. For the first variant, "**Remote Payload**," it uses the GET method to communicate with the C2, receive URLs of the payloads to be downloaded, and encode them into Base64 like: `5FZQY1gYj0UKw4ZC99d1oNYR8LvTPtrfN357Eh5gmRvsMaPYgXtMxRXpMb2bTFOb2h2HqMnvUKT9CUpj9864gckmPUzf9uLIIU9`. Then, the payloads are downloaded to the `%TEMP%` directory and saved with a random name, mimicking legitimate software like **KeePass.exe, GoogleDrive.exe, UnrealEngine.exe, 7z.exe** or other software containing the Rhadamanthys info stealer, packaged and protected by VMProtect or Themida. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766548662722/f8da0aa5-70f8-4167-b031-31b270c3f288.png align="center") Next, the second variant is called **Kidkadi.** Unlike the previous variant, **Kidkadi** does not connect to the C2 to fetch a payload. Instead, it has an embedded payload executed through another loader dropped onto the disk in `%TEMP%` as `kidkadi.node`. This is also considered a gateway to trigger the **most dangerous native payload behind it.** ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766551396446/f32c295b-85e5-4305-a5e2-bc8309f80d38.png align="center") Finally, **LongNosedGoblin** will execute the most dangerous payload in their campaign. Here, they will create `SEC_IMAGE` sessions and **write the PE payload into the section.** ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766551619339/b47bc76c-4551-4e5c-a6fd-f3608ab2550b.png align="center") Then they will register the **Vectored Exception Handler (VEH).** If you're not familiar, **VEH** is a legitimate Windows mechanism, but when abused by malware, it becomes a powerful tool to: * **Evade analysis** * **Hook API** * **Inject PE** * **Trick the Windows loader** After that, they will set hardware breakpoints on: `NtOpenSection, NtMapViewOfSection, NtClose` **to take control of the Windows loader's execution flow** and **manipulate the DLL/PE loading process.** ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766554191351/e3d1cc36-3976-4754-b734-a6c1f39b054a.png align="center") Next, the malware will load `amsi.dll` through `LoadLibrary`. As you may know, `amsi.dll` is a library of the **Antimalware Scan Interface (AMSI)**, and naturally, when loaded this way, the system will mistakenly think it is a legitimate `dll`, a familiar loader, and completely normal behavior. **At this point, the Payloads will obviously run under the identity of a clean module.** ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766554276869/fd8c5a91-52de-4cde-b258-56f1e71f1810.png align="center") And in the campaign, depending on the system, the Payloads will be executed with specific purposes: * **Steal credentials** * **Browser data** * **Crypto wallets** * **Persist** * **C2 secondary** ## **Summary MITRE ATT&CK Mapping – GachiLoader** * T1566.001 – Phishing: Spearphishing Attachment * T1204.002 – User Execution: Malicious File * T1059.007 – Command and Scripting Interpreter: JavaScript * T1622 – Debugger Evasion * T1497.001 – Virtualization/Sandbox Evasion * T1027 – Obfuscated Files or Information * T1082 – System Information Discovery * T1518 – Software Discovery * T1071.001 – Application Layer Protocol: Web (HTTP/S) * T1105 – Ingress Tool Transfer * T1620 – Reflective Code Loading * T1574.002 – DLL Side-Loading (Advanced Variant) * T1546.005 – Event Triggered Execution: Vectored Exception Handler * T1055 – Process Injection * T1106 – Native API * T1562.001 – Impair Defenses: Disable or Modify Security Tools * T1555 – Credentials from Password Stores ## **Conclusion** The campaign by **LongNosedGoblin** highlights a concerning reality in today's cybersecurity landscape: **the most dangerous threats don't always come from complex attack techniques**, but from the misuse of legitimate administrative mechanisms that are trusted within the system. By exploiting Group Policy, popular cloud services, and a custom malware toolkit, LongNosedGoblin has built the ability to infiltrate silently, maintain a long-term presence, and selectively gather intelligence. The hallmark of this group is not speed or destructiveness, but **patience and the strategy of "sniffing out" targets before taking action**. Collecting browsing history, categorizing users, and only deploying a backdoor when the information's value is confirmed shows that LongNosedGoblin operates like a **true cyber-espionage organization**, rather than just an ordinary cybercrime group. In the broader picture, **LongNosedGoblin** is not just a new name on the list of APT groups, but a testament to **the evolution of modern cyber-espionage campaigns**: quieter, more selective, and harder to detect. It also serves as a reminder that today's cybersecurity battle is not just about patching vulnerabilities, but also about **protecting the trust within our own systems**. ## **Recommendations** 1. **Increase awareness of account security** * Do not use **duplicate passwords** between work and personal accounts. * Always enable **multi-factor authentication (MFA)** for email, Microsoft/Google accounts, and VPN. * Be alert to unusual login notifications, especially from unfamiliar locations or times. 2. **Be cautious with emails and attachments** * Do not open attachments or click on links if the email: * Has vague content or urges immediate action; * Pretends to be from a leader, colleague, or internal department; * Contains strange files even if labeled as “document” or “configuration.” * Report suspicious emails to the IT/SOC department immediately, rather than handling them yourself. 3. **Do not tamper with system configurations** * Do not: * Install software from unknown sources; * Change system configurations or security policies; * Run scripts or PowerShell/Batch files shared via chat or email. * These actions can **accidentally trigger or hide malware**. 4. **Be alert to unusual behavior on your computer** * Users should pay attention and report if they notice: * The computer running unusually slow, with fans running constantly; * The browser opening/closing automatically or having strange browsing history; * New files or shortcuts appearing from unknown sources; * Unusual login or data sync alerts with OneDrive/Google Drive.**Manage Personal and Work Data** * Do not store sensitive documents in: * Publicly shared folders; * Personal cloud services that are not approved. * Always lock your computer when leaving your workspace, even for a short time. 5. **Regularly update systems and software** * Do not delay updates for Windows, browsers, and office software. * Restart the computer when prompted to ensure updates are fully applied. * Do not disable security software/EDR unless officially requested by IT. ## **IOCs** 1. **.zip Archives** * 062d342f59136c3bbc729e0c412d2c2589b6f9058912583eeb9b61d7916db00e * 34e1cd959c0c586fcd495225803061e6e2a19e7818c47a46a47822ba6726500d * 434fc84cc190bb0c8af86d3566d6517672fed9c171eb0df5c7541f0dce679c8b * 606eca698d0d4a67b21428b0812a261daab36598fded60b189106b0b27992225 * 775b05b8cc8d03751828986727cd1929caf6868e1df9cd21e9366c48ce161c5e * 872fde8128f3a0f074975b6ca0d83fa56a8289b2063351f298bbf0c9025948d3 * 99f4755fd9b25aadae4e154d661ccceecbbb3d4343dc6c81e04aa81516be81d0 * a4e2c0ffb93103db23777c12b48a31816b83b0799c9bc71e92bb576e884d76d4 * b48f3e7e6c67bfb3c73c85a33a377f9bb840e1b7b09871ab29a19cdb7965d5d1 * c4266da90d6c655388ae8d64aebf5f9178adbbe486b2249e6bb7d18451f28a3b * cc95609cc375263129b8f425800a9bb462055b11dbf0d8aef2b3312aa2e90daf * f0de35ff0b889c7e93a89e918488a33aa21e4b6e7743ae87f1993ea77b237ecf 2. **Variant 1 – GachiLoader** * 00bcfecad4b679f72c50cbdcd883caf55b6a1f641258a636317871c7b8940156 * 00db4aa911e95ecfafa6f10ebfeb9f0a8051ee63de51ea1d9515ece5be2a294b * 01a3da42f74578c0b7c1146f30eceb2a2bc26c2d814a48fcf29ae527a1048aff * 028711c1b435c773ba600a863f4d4a2d1218860de799a1275d15d4ea93f0cbef * 02c0de5116d9b05d930e4858cd9768cc2ba70e91be62690439537fdf0f52de53 * 032a297bfbdc94226f0d88c77ab27148c54ebde6bfa2750fed09b1d8667ddcd6 * 03d55245ef2766943813c0d1eaa3859d3918ee6fed2705bb5eeb38f4f87a5643 * 079a180eeed0f4fc84c2412ba0398a79c5262efa1d9e8fd53290cd001b5abf9f * 094240cd298de1121da36adb96b3cdd632f866837f27e3951b6a0a544e5437f6 * 0a6d41411ef3c65540a525dc5c3ab0964cd595aa73c3a477a8a96ec986277660 * 0bd44592e75854a1c763384bf9dcea6dfe1174f6f45df342ebd9dfaa3a27dc85 * 0c03845b9e2ff5ddac56f6e75b8e9dadf1a7bd1681d074e732478596b3173922 * 0f81656ce724b65c230c4d63259c3a0edff20cc664de964f16451417eda60005 * 14bfaf75b5c7ffac451f41352f8e94b6cc060efe7d645189795fa921f4e602bc * 16b2f7d9d4ace9e3004bd47f97c252a7fea21662656ec6b906d30a6b21900fc4 * 18649874ab887ab613a3ccdd7cddc683e2b21f7cbe0762d2ce8201fc7e57540c * 1d28c23b271eb2156bf2780cb0dd042573f38f4758ef61877a7347bbbc756c8b * 1ebeca5dc62d759904c47597ebeb67865017a99892081c94d7647206b78a6cd2 * 1f35a5ee4ead5c286f3e0d3ddecaf8789f12da7b8b7422b0511af619353284b7 * 2038f38ccd42cd1df84abfb5915e3a6eb9c976b8d822768068343716f46a09f1 * 210d821109ec1dff3b92ad3cfdde59912581327f4017b754864ba1e263c3c366 * 2601d2c2b4515d3f1414d4543cfe2091490e2502457eab6c437a310f7e5e2a1a * 266216b097561e57448b940c3087b82c4cea7581b67e5dcc52c8c4dfcbbf8333 * 278c5a0acd6603947e59e1961642279e29cc4b9be299c8edb7b719d6568eb8da * 29fac0ce48b9114990a4dd942d6de1da55bf9c49938929123fb1f221be385eff * 2a87f4d47ad95f4eb46c08a4d33fd4732c10a1408db1b758871dfe6b1059c6bb * 2e5389a32a6c21fec476fdc6e80fcb577de31c43adb7c090c3a11f3b048787ed * 2fee47e12ca72863ee132d63dcac3b39aeace1a4d71b0aa14a30b56ecabf29c9 * 30bcfa6bbb5e9d9bc64c65a27e1565a9ad21af3d5e1f202933a340cc400abdb9 * 3124fe59b26dc77c1e4b4d615112928ca1830c890c8c77e853ac6948069ba463 * 3151700d8f13cf55ad46148cd46ccb0b3409c0adf253433f16ef6612e9280eb2 * 31dac5bc21b0dabfac51cb99c821e62421c39949971a44898a1ec15efe33e8c4 * 32855dba1ec6b3c9ba422cf9203d8130e59dcb5235764b8f56b6d02970a5e5b5 * 33dce93dfdb43f47ef1d36e2dd16725ed365300c371dc45491b52afe13b6e412 * 3630538febdedf693ca9d996c3f1998d50c97052ab99e653d95b381ddb3546ef * 38a7feb5ab611e6a487ce8b048732f7721484ceebb316fd34c9cc611dbc4e3cc * 38ac7917ce895448203e6d14f121850ecc4ff89f530e792c794d771f881c7b07 * 3c16548ab32996a58298978b20db1d4133827298e166f93b7c943dc3ffc51782 * 3d8c1469de3bb01ef72992e07d1feea9380183983327576978851b8c78ea7fc9 * 3ed63941e7411e93f644a064094b5a6c7e2a9547840a5198dd7f6b4d45ef9eea * 401e7b72f4b7ed4119b625ab34c2c7d37c0dabc08bbdf943fd291445e2fe753c * 40f899294ea02f7a9823ada63c869ede18a8afc6238aedb62d2b30a2744cb846 * 4210e9e1df0bc41e497285483782609c0b4777ef6682fb40b0d25c8149c9f3d2 * 428f86204b69f31dfc3f3479d18d23b15cad63d72998a8418e8da22941c74956 * 43b1a11962f83db6bb59bb7467d5456e852d0421ca5eaeae3a249a34839e67b4 * 43d9130c8f077a5885842bda24bee19e4dd231c49f88629442e5b9f02ff5f33a * 45fd42669157357f1e16c0b542eab5836061f5b2e2160a5104a4bde38cac85bf * 47ab9b9deaa14202b94320df16f52c8d98adee49c9bff8909ab5deefcbdfe401 * 48a269d2c083868e2b5347012afb85bb3c233c9f042985bcab764f7788316660 * 4b71d8cb7ce8de8d557283df3543aa2aed89dd5446c7acf855c0ea2e5e7e89dd * 4be48937c603c910c29de2af3b0d3e3bc05b809b19190e90ade2489a347d8b03 * 4ed90af2fb3fe13eb8ab69fe2fcd82a0775426da33da4ba043d7e7e2fd4a18f7 * 4f8c55cb3f99741f4fcccdbcff07c7d0b8ab7fa23dcbf8847d7a37a35f6d3f5e * 4f95af5b4a1569eb54f6995e547584f429a49895d0d81c71d74970275b170a08 * 5173c6b57642dd89dba2f039a1ad630d6d73d3557248dd09ca2a51a329e6119e * 53ac3b1601f2fa43121cfd43ac9b49f6751a8b84b4ffcc5a1241f71eb1e8d7b8 * 5538d6f24e1330c934cdfc95188aede5c9668154376e507c41fe1c752cdd7a5b * 561436df09f87be34317eeb25a2b7bf5c67201fa501262f72a9a63b9977ae217 * 59c93f81063e8b77b20292d1d03598f74d997690aac41f5fb7a248ac8ad866c2 * 5c88a6efd0a713460dcf8b828575285be3a43d6481e245662bafb3472d344dd1 * 5d1bf72af319901f22d78625d60c877d7a8d6c54bbbcbcfc643376558e176211 * 5dbdd6d45021383a3c76b2e0c7258a7b0fcfd70904602eb2fb1afe3b33efc80e * 60de97fff85ba6f0b114fe565f53ffc1ef43a19de95c31299884e034f05dc037 * 616b74a6b17b70bae357c43cf03fe1946abc36eea1d0e7d911ca29bd067f63ae * 61e215ccf73cba014ecd72abd38ff78d5a23c2727577c5b3e2c8f52b90dc2a4a * 62bab101900a92db76e2c368c4a83f7340f42c460b16d11dea94c8db002d5bc9 * 62bcb939df4a8b7bdc896cd229cf34f55d93555c14e5816ac2aa6285d1cf4112 * 6463e7f48f01f482fa846bc106de245c833ad7c3ea7fae4caa7ead54b2901cb9 * 64d6d018e3b7a1d718b96d9950b3579af2a784ab004ad575e13cb41b2c27aa25 * 66e684ab10b1daf2a46df1031c6ddc331ab80af4e21144a68997d4a1859e9fd7 * 6985717a754fe121e99c337cc33b0e9a25852fa33c580dc9caaffefaf0908233 * 69c0084b78bf963997033759fa45933b61de425aea7612a06289ec6c78492745 * 6a8dd64af57926514131efdc388c9883db2c23aebfd8b97c44e808d637f0fc23 * 6b80c4fa88fbb35af2b254c63586fd6e0455d0e917b842afc79b821ac87a2b9d * 6c428016506c2ae076d049deeba60514cb8c0afa6fd00fc349722cdbc6e1b305 * 6d5af67f05c9db6763cd494f64c5f62faeb8f1b67ba26a7ab278e27d4c9b8f22 * 6f1b97838bc5702954ef5f536de86a8477e0008f25bcfba72b7fda4c1f37b9d2 * 6fcd071c6ab51e71407e8bf242fac8552a10aedff113c9efb92ccc53cc49fbed * 7029d2c60ee04772d9dc4d8d34f5effd3e3be17769584bbf912954e926280131 * 71415238f740c7528f3314f94dc07ffd9b802a34c3997b09ad02da1bcd3c8137 * 717f05b96a344b1fdd159b4c45e3089a26d1f64e63cd4ac2ed3bf2db33074c3a * 765041cdf97bf0b55734cd5619d7d4568a641ae3fc35540344a488184839674b * 78908b01a8d959b80f7fa1f42c734c4c64a8cec58394f94cf362b8efd38c7b9c * 78b6c96910d8f1e3889bad17f97cd26aed5f6c7a15432cc11c2224a8c9adf691 * 7a155a20c1e5df83b566fdad3bf59ca49ac6559e0561233a95c7cd70a5caa6dc * 7db2025192f4f2497bdc356c1920dfc4740bb868de8a6b5786f01865dfa9e564 * 825bd0b103d647c296bd2b9eee251b04b7f5dc72f27898fcf0fc25ca24587125 * 8295cddaf1c23d554b90e4d1ee1ca064f68124df63003a046f58241c3513cd1e * 8383a421e9a4f55af53cf1911680042659b28722cff8a30cd202bc728a8fea23 * 8443994a687269f2d7d19678e571ce1a1658df7da69c25b4bd902f87f849c98d * 857f68127546f829861e796b11b80304e2c53e70e54191fec8087f64d7c8146d * 86082a735440124bae953c0a68e5eff6a7fe6792f90ea1e71cc0c83a724bc273 * 87c1c62369657904418affebca3f706a4e968dd1a672729274ba287dfae43be4 * 88938ad37225074c923ac4baa0b4a171076c273cb064a4905c66a25ca3acfee0 * 8d473631c12231079a241d63ddc9e4b537d2531135e9aa4d795abf22f2aefd39 * 8db4cf8f666b7c4ec5051139570b5d3b88569c9e62de31249a70b6cdc716aecd * 9211d6fb5db70a51ba5795e0a7126aa1efd0f4b78262031dfb72e98c319ce37e * 95760397b9cc05d0180258afee22cd8e6bc997e13754a11cb737733d0beeb444 * 95f875c01b889f9ba811dae11822c6c83eb28d8260f16ca070c76e83f6f7e7cb * 96d2c11dd5bb43da5945259494d7e26a68b5c48eaa32d5eb2d1dc61aa0dfb7fe * 980d0d78b3e288f24bcb793d2e49a4e26138cfe4ef272171557658be751d277d * 99a3a973caf956102c563773a9a58ff79c539c7c77480873dd0e09fa259b3594 * 99cc25edbc65ea201b957abbd6cfbd7b3b6f04759cbb47fc999d35508a654748 * 9a0ccafc516df1e931ba2028ea59f39b31e1cc812c3a2ab1765b9e91fb8cc507 * 9a28d80ce2c191d743554313edbb8eef09e6f72b34c4d701c0a84090d61264e9 * 9b60930efa096a98d9fb6392c74f8d3e5f2df6ba8a5b31a304b7fac3d847e7f1 * 9c562c28323e7681c1cb5a4b23e703c21cda8bc020946de691b6765fcb613a16 * a9ec251b719b2ebb85e50f43eea4e2944e0a065daaf5c92420efc852b594d96f * ad27bfdd9d51f81e6e743ed351c47812874565e89f6ace03ac39d6c85fefa949 * af0891bff41d67815ed7a979fc2127295ea662079afa16d09d1a377684d678ba * b1b72689afa038d413e36f5aca61b971b69e4e411976cbd01e3cbf5b2e83141e * b67ac42c0ef7402dd53dc950e8162e9a213aa65d5a7901a5cc4aee0b93058b93 * b6a3ad06c57b45142dd7ac2c77ea70980296b5d168517f5d7ec4100ec10d305a * b8eaa5c0686fb49f6f3e4edd5716df48581001249d5e62563f2468db73526cce * bd378786d84743beb0adc8d3dd14ff3d7996caaf6a1eb8783c665091ee9ae225 * bd7df13098f3984a18c4a21282ba04ed802bb73c1f91c7eb5a35b89544c545cb * bfd049ef7d1384a25c3edaf857b94539525b5f442dbe543fafa2356315780d8d * c164232a5a3a2b49705257e62c5f8e004df68e3cf32d7702e4af879abd55008b * c1a6587fb04a94943ab616cf0ce8b3d0c55e59ffbd4bc9b3a1add955391210ae * c1fb323ed08adca20912906e8756e6f8a805cd1d08cf20226f37cb51f33117eb * c4cd91a5ce722f3c510151513501e9aab54ad535b934132e6e6f6c9c76be2e9e * c50c73ef1be87b84055ee73bda503ad20884fcf67b207fa918190f40f4353729 * c5e9eaaa5dc6ec4780c319c26a4f552f7030438dcfb008ccfd52358512dc3f81 * c605642e0edac4b63e9819648f79d54d5f47cac240480fad808cbfb61f31c88a * c67bad311a48bb86a865b08ad2ef175a17e46063ef3c5de734fb3c4a5ea07578 * ca0c525bf22b499b2f374d41f7e07a60ed9181645af485b0183c65eea68d364d * ca1465224a206c9323a4a3215afa402ce7f592ddf17db5d477d2a5905e982d56 * cd6c1ebc720ba509967f9e508657ad02d8fafee1d958af0174bfd0d192291d0a * d2c3f54b03d50271dad1eba0abf1cad6529d67b74015e530f716bd18f943c6b5 * d52894f027b8ce185efa3f584024b8a9a7f6694f6e294aba8ddac9789d00468f * d56afbac1b7eebdb1aa03744cb45a260975de75a08e7f4d9a89ccb57656d9b65 * d5e05fa6ddbaf68f6b08e188d444b664a08a69a6102df37c4c3c3cbc7ebfd326 * d5e530f607260ee2ce19ef3f6ac277b202cd15fc947b0c02ba9060421f799bc3 * d64d4ede406cc439617a2f17e31a3d9c1adb81d35cbb97de1a7e0145b03a08cd * d666dcf48f569d6ba9defd87e149408373c0ac237a017624fd51aacfcfeb89d0 * d66fb9cc2c40311df8af5aee664303f5226338cd0f2046cb2f8d8d42bda6f9b9 * d737d53d2fb7a233b9732bfcd9c99ac8ef9846ad65af07cae490c8ffd9dc02ee * d858fd5207e758e84b7ea1a84f27b0e782d0cf3a39db9fd72c3869bd136f9440 * d9133df2668bac02ab8150fe9bc7b44a69936322b624fdf80a4f0de635970e81 * df481a8014760def4bdd933639d01e8381fed910f5cf6d0e974560afc446451b * dff27eb46d17a25416a9cbefb705d13ccaf8bbc03461f3112fd5132c6261a187 * e111cbbc94fa932ad24e84cb308195ad7d05fa2d9bb2716a0f6f9c11a4c3f570 * e17622f041536a253ab17dfc10011a65225356cb120970b4c4948df1c37ced23 * e1d90617390211860b40839338c235df016cafeed7bdda9f39b17b86f48a9fe8 * e37d2b812d6ce5653ee7c54157b6288469152dd64a4cb3cb25943bbc3b28e909 * e6cdc47ab4a4496d42d84281d5d89c4fdad665cad0546e820aa29e9a18d454f2 * e70516e7aa7c9dbfc459993516cde705685f1e44a75c29c55d9f71abe7733c78 * eb3f6f8f99b86d4a68490e56a6f5a963523743685ecb6c8bd1d87389dbe0fde0 * ed74747bb58f78df2c11f247cc173051cc0e058fad7def595d14b8ce03889a53 * f09e67864cc19f5b831fde944c7ee917cbd3af9ff89ed4893d2fa441d12bf5d9 * f25531eef40e268b251ce117375bbcaa1a586506d3fa56fa722b200713ee4c1b * f37df47e517702f3becf6e3c85733dfea0031572bf199c1f56faad951b354573 * f566a942a7c59f53efd9418f0c97850a749a806ee84e88056138c699d3b4d08a * f624c81e47e350123490897fa04fe43886ae9cec9b128e8b9ef54fe9405b4612 * f64a20a44a60dd899bf0cccb5de57897dd80819cd36c55878a56ed0d1c995352 * f8a881216fce67e89b8a56774504b5ea86ebb763d87ff7426a9344d13790e7ea * f94c8771545fd31371dcdfbe80260378709e686b44c2b440957cb923aa952b37 * f9bc90f545b3eb8d5bd963d00debc6f3ff22403f94f91d063f18a7fb85be59eb * fa1bd55fc9aecc625992448306e0dd456e4011bc07a926046ed6d3280aededae * fbfa7f980b0d29f8c12933ef68daff306e2cbec3247db8242a5d97e6a96927d7 * ff02edab9a670769ce074b2f6d6728909950785d2c8507e01d3333de98156c58 * ff89d6917b775ef0bd38e4ee3a401bb310c4276eba79ff872b827920f72185b3 * ffd7d43487fa1e15d8ea2a1e8737533cfcf7763cad6cb7504f270500a37f4261 3. **GachiLoader’s C2 Servers** * davpniktonevidit\[.\]cfd * nupogodi\[.\]cfd * 94\[.\]154\[.\]35\[.\]99 * nexus-cloud-360\[.\]com * globalmarket247online\[.\]com * 176\[.\]46\[.\]152\[.\]18 * 213\[.\]209\[.\]150\[.\]104 * \[vault-360-nexus\[.\]com\] * iietrich\[.\]cfd * mceenzie\[.\]sbs * 62\[.\]60\[.\]226\[.\]233 * 66\[.\]63\[.\]187\[.\]72 * digitalservice365cloud\[.\]com * 178\[.\]16\[.\]52\[.\]231 4. **Variant 2 – Kidkadi Dropper** * 01bdbb37d4b5d22ab98f1977f89c0eb69b35cdbf1d690c434a9d21dc1d0c56b0 * 02bdf8a8206b520db3d55fb7426ecef1ad10518f22eba26c848e548b75bc9999 * 04bb04bbea55fa1dabda974b2c2f4aceb44ddccb7b9c1715e0aa67318369a768 * 0577a28c0bcc1b033f44f458ab2d068fc301ef30d4175a3d2012d3601e9e13e1 * 0859936dff1e2af60940c5f0764e187c642ffea5344118eb702a7ac59f5a9281 * 08b5875f9867aa6c71cb8d96fb79de9f8975e0f7d1298388c95845aaa49e55de * 0ef9623e3ba8bc2c5be6de9cccd4a9e17bf74d1f8f83455da40c35f72fb34922 * 110a17f1d65790337329d22d94ac10a9b6581202d5eab02897cb41ac543f1007 * 13f1ee54ec2f7ca835313b828c64d1b0ffd6288c59e3361013a17c765da7335c * 178a24418d3057eb38b80e63786f9908a856618f1d19a9b667a55dff2717c9db * 20179c8ceeede0056b0d3f545d0641160490642c90b23dce5603b8b47acb62d0 * 2101d91dc775638f1f392d0867aca9a15d9139f0c986ed7004df134c9c52fcfe * 254abb6da9296f8c6f8e567186e3d59ddba2392fa4baf791492f7e76b4ff5af7 * 28a9a74d8eeae80de63a1938cadfa55a5a0f334e593e975cb32af8ec3cae79e6 * 2aea932e216145e38e5751f4daa9788974dd8e4ad4e90d7b42613d3df6341aee * 2e519a26e3cb67b9e1186065c4245f89b8cdfb5b3346fc86b028213e0f08c286 * 2ed1c34780a3e9d2972f14d2828abf77a329075bd4c055458ef2f064237544b9 * 354a66191805500b4a45d7455fd02527ffe0b76ae9285eabf8f182ea7d893c19 * 38063272da02cf4fd383c634df988c07dcb2ce59cc3cdb036c4ff155fefc62e2 * 38da058e5fafbdd9c371f4d64e7cc0e317ad1e59291470ddf01c7681c0c03c43 * 3903bab79a2fa38e05df6f311d2dc9640c5916f8050bffab0d47ab8e58837210 * 396caae9215849b674eecb0f8d5b91985f81986069c09e50454cb8f607ad4231 * 39c72a4467ead5190ab2aff718c1d8fe66dd03760b3c2bb085466d56a6d10f3e * 39cdf78fdfeeb8ce82f5a8b0abbbfb1a74fd0bf9568e11a9b5f5d47060c33dc7 * 3dbea0934dd2de6441ba27b762dc6424ce518f4882555fb96cd5225f9167339a * 405072e611a49489d1074dafcd84791f60ab9daebf55be36b924718e9d847c48 * 416b81138d3c20578228c9610dca686eb7193e8d93cc4a2a18e6815efeacb810 * 425d78b7a5cbd87b36e4ca991171e90851d0dac29fe5934fe9b289ea88793298 * 46926ff7f778ea242603d233eabc0916a8a6945769fa0ea20c60cbac1f164150 * 4a509f3605cb039c6f426e110b23ce82f1ef67db06c32e4bc5ebfb3ae3ca1e31 * 4bdf84addb7e9bce6bb98086e6554f68fd529c49ae20b770d8db9ffc9debd3df * 4bf54789913bfbca6bb87263137ff6a662e32eb9e9ff124441af6304cc2b401e * 568e8082704d7fd2473862e93120412de1d043da5d106a12f9d1d5f1492eb173 * 56e4bb0f077b2081f0fcdaeaa90d8c6da48beedfb0a381ae054030e5a2988f05 * 574934eeab1d23c163c4e59cad869de2f5c3d46dbdd563b17fb4320b53e95770 * 5982d92d6a3bd210fd13a9986bda7f9fc6cb0321e523506acf9dc2e9ee6501de * 59a17d129944bf8bc426d23746b285522d94b293eb2c2808d56a307022e5b92d * 5a290d01a08f774f13f0991b7cf5c8c48b8cd2c0eb896ad069f02a474d8747f2 * 5bd83b8ecfb1efd13191a76cb0998cf6d645491b76b6fe4f1a516bfd756bed3b * 5e4ae0bdc6081a22357e73aff3023a63623f3475610b23c35ff073b0b6890175 * 6253d1285a7579f482ba1983a2c4db2c01f9f11194dac76aca4424e3d6977a02 * 62db621c97bdaadffc1e900aac8d3af6e4e759b27018da635418c3921e1c8068 * 679ff95c8c383d55b60d80d1803f347e206bd358e3980ee8de1de105680ffb37 * 6bcb16d0ceae1b27bc7860477aa60a8c2a2588fb7625aa3a2dd78ee543658437 * 6dc57007880918de4ef89d98b70dfa0cb1ac4c7a9d1eeffc57408d3f18524980 * 6e087f40e4aac5fa780bfd1046c1d65e2b59c6abf391f9507718e61be61ddf42 * 6edb286fa173145e8bb9597d8f02ec3d86f9f680468ba48618bcc5d2240ad121 * 73cf316dc4359d80022e0ff7be22b9c86530e982a1d939e78a20090b9373b8a4 * 77c728333ebff9d313d87b763b9d8e4a9d580b76f734ea6e43d7cc7bc81da260 * 7a70e48a2721d5f5946ec2904dee105ba6c8561b205e5e8fce2aa5f6f3ef0549 * 7c53826ea6a9f4ba8d44ca455f1723af9d72b99e97d5053babcfd528fb344e24 * 80e8a40be533b4470275d567f7f9d21f6ba4e41e9b3272de77ff67ab9f8442b4 * 828c2b61686f9dd8ee888a89ad92793b586a273b57bfd0ad57be6ae2f72616b1 * 861c9536994ea3bb6c7aa5463001b79ab61fd945cf44956074d9034e384b3834 * 8b30ecb0376e7853c4b323e6b504c967d76f22aa880c587878aa4d5de9bd9808 * 8ee29bb1ea8f289d2233fd8053001a29b4fb7d5275120bbcb3e92f5cd5a77b47 * 8fb633896f714598c3b935cc45658f3fa14c99a006708c0a78e2f7d29b4c2b1f * 90f4f2c7d5fd9ea10e05cd9bb28a7700fe3fd5cc97d5d59b7e0f043e74f4adbd * 9dc8628aa94effdb2e982d10a6daa4b7897b75db9d452d806f839c9099c01fd4 * 9f074ac880d8ae454c84dc03fcbaf0a9c4a15b32a28a590708a38ec6542fc620 * 9f38d473a87c4c72760dd3e578c21f23b271c3c6a28d92e9ffa842073c4abc3b * a0857210ed5a0e38a73a908158905f4271bf82d3f18e0f73494c1846043102f6 * a21d016f92be196e4d101a9f20d928ededa930dca835e5bdaffa0ea96372530e * a3bdc6f2f7930af9d4f3378c88fa9c84ee36c8a79b6689c0907fb4e065d7b572 * a66220bea0f76e47ca218b99a2b91c7347cb3a291f2df03329009fde23c1a02a * a745b6efbb006d7c9c33503c12f247a95d3d72b98e22f6aa883d7ef45359afdc * aa71db5eb8ec06fbf676dacbb53bc3fdab62169b7287fe5d489713661ddf6360 * af14df77f75b1440cd98dc39e4fd24e4d4da62904a699ca2e977c91db30ecc0d * afdcb3443f1b46fe4bd0818654dcbf48a542afdebef4c0725618cd66b2dbddf9 * b10e7bbe60e82ec581a3dea4d829838d9c9603f4581125d0200b620d366c75cb * b281b6ffb8cf114b5836ead7cbc424179ac4070e2b15721a5a84af6be0b376d1 * b8d46875182730276cf2a67de909ab4b8f3f298554f39928b418984d8cb515b0 * bb359ebb2ddc1489a3489c0c37b974d05f9a37e23d4e74517d882fb5c7e493b0 * bb88a06cff4e8d73eef046c6a8352dfff7f52903761ced27acd68c065391a464 * bd2fb7d2bb7c15d634a986068d5cf811faa83aed72cb7e81df5e5082b22356d2 * be68dd32a6b3375935fac1cebf132a2fc7fbfd4074cb8c53022d8eb4e7e17db1 * bf5ce4b2911f2d6592abafaf5096936e61d23f98fd9a6b6bbcd763269fba729b * c0b239f989ecd535b9e80570487a39ad67c1e77ba3133caba150da7bf553b724 * c10d286de8111a7133831d57394164586584157da2b50d7f3bb85582d69c2b17 * c26b86a7e9ff0fb61a2ac0e9eaf78ed34e97a0326df66c7d2311ee7a6033e590 * c2b66d97a64d87ce48eb5fb972d23a6b834a677ae154f9f8d4300e9699922ca5 * c7646b0f6de08759e19928e25f2ca65cd023a9b820101ae52eb2dc7c7f6f1a69 * cbeb46542f05028aee563efb5afa3616612637b31928f98b3d880de2ca524fb0 * ce5b2579a7893c29ad24ad7126cb83ab629e1d879f69348ad2eb5f9b884d4c44 * d1b7ae2d2e12faa4244bd4e5625ffbb2e525586f888bf5b292386221672b5b6d * d5038061e4d308341f6dfd7e807c84266442dbd0afe3b567082ebf6fdbd4c5d4 * d51e67e9d81041500994880ecbad47f43a66fc4779a5f79c2c1f47517b8b14ec * d79722670889cf3ce869ed23be59c12029e0df3e536162045b6a87f0b522672d * d80cd0fe212dcfd4a0e683d36c48ba73a7e500a31dbf3f629a13c89565db7580 * d8d138f4ebb7a5f12691e2c4edddcf906b66bd5640f8e09e1196a629a624a2ca * d9e2773a56847f4d28e82b2e7215bc4db05807a08d49588f6d6b40be9a430d1b * dbb8a2943af9559d4b3ec8e4c0879cfee3edd882e78b1cd1fb4546acdd7365ee * dce1732d7e260843a9930dea78ff1dc6c469bd306817c827318b56d754f77a98 * dd851d7d8b79900e151f91f82d9f1826db493b67f012829783001ab5ffe392e2 * ddf5f0ac5484e8e3090b9ce51f53f57cba9550be0e5fcdc2b60787ffc31c15c5 * de13a7f1f2cc3cfeeaed063b558134631add81f74e58595bfdf921ff78470a9c * de40f512a3ead48f8c334bcd92198304df41d166ee0c0a90dc4a281464ee7980 * ded2e57b60ba81fe9fc9a52ee0591db262527a0b6d166c6ca7165bfb99c4e835 * e076d0d1bac228175f0ea23046f0bb7241b0a0457d245ae365ec3de8554a3499 * e2627e6c31bb30f791ae80fbbf7d6b57a9ce6ae9e568cff6942ccf6f72195a5e * e4d7ace20cd9704805d144c26bd8c54f6a1b3175b549b6c8279e2d0ee81da9d2 * e58ed739c3e6f0f1b0aee262ce0cd99cff6fa04ec7bd665c7c9de7fdfd289c1e * e7372984816703e5664bb1a0632bd7689d573e2868ceccd138c0a5a2977b2a23 * e79d67e6c265ff53fb428123711db25b5fc3612ae650b55a2c6484bce3385bec * e806c33313e0490293edeb998abcd9413744e307af5619662ae6a62f6224aee7 * ec55eadc6aab2a8c519c016e4b238b39463345c87160b7e2005e6e38ef05ff21 * eca5155749b0f83671e8c17094a4380c19a3b5096781bd7b88cd9f93a70fc574 * ed0cbb7b137a10493319473610209016f2c1a8b9560876bc32999b472a32e18f * ee363c5bdc5e786b0b47840d8fe69a5bd71f3684a9eec5d9e49b9ab68c64c793 * ee752ce83f645fe4d3db0b1d8c41428d7b9adf37e72a9c21c153450862d30906 * eed231bda3ad5a946a254d06865610e50b05eabaece8f09f84323d9fb23e2742 * ef4d2a7ca4306626ff90e53ebad63e243a50dff63f34eb0eeaeb4acb2f39c42b * f0269f2b26534acc3ef8bee5b243c54b14812769249a974b2e2b7eba9734a967 * f1de30fa0eeedc1f1a7d97736cf751c88fb01456a182f97ede7294bc89bf69af * f4f18af4acee36826b8e2162749250ffb96fc7f8f154d181dd1b8179cf4da68d * f73e65f624f15d967951a6795c712daf31363ab1602485c164549b04989caaaf * f9648d34727738abe86310378929ab7a8d5c8f2698c913bc84dee9be49e3b96a * f98ce437118aeca437a43612858068f4ea6099bb93c63f1b4ffc4d4335e8eaed * fbae3424943aec7aea7ce380c7a83c89ca9c6ff243bfac5186edba6e560f5b66 * fd06caf741fd4e5fc9f00c575cc22c00f1a7fd55e826a16dbabc8b3436ed64c4 5. **Rhadamanthys C2 Servers** * 176\[.\]46\[.\]152\[.\]18:8181/gDatFeDway/r26ggaap\[.\]dssde * 178\[.\]16\[.\]53\[.\]193/mK2k20ajW7kairt1mg88vT1aT9vwU5AZN9AkYYs2QBNbnXV3ph/YEr2KP0jEBh * DdVcS9cWNhbKUgDxcEm9kqxLwFAdHgmKyw7FZq\[.\]exe * 180\[.\]178\[.\]189\[.\]34:8181/gDatFeDway/mh3af5md\[.\]wg4ja * 180\[.\]178\[.\]189\[.\]34:8181/gDatFeDway/ujp8k5q9\[.\]kbtsk * 185\[.\]141\[.\]216\[.\]120:1888/gateway/st2jdbg8\[.\]gsg45 * 3\[.\]126\[.\]43 * 78\[.\]16\[.\]53\[.\]193/mK2k20ajW7kairt1mg88vT1aT9vwU5AZN9AkYYs2QBNbnXV3ph/YEr2KP0jEBh * DdVcS9cWNhbKUgDxcEm9kqxLwFAdHgmKyw7FZq\[.\]exe * 94\[.\]154\[.\]35\[.\]99:1888/gateway/el3tkioe\[.\]xcg4w * 94\[.\]154\[.\]35\[.\]99:1888/gateway/mbw0n34s\[.\]gibis * 94\[.\]154\[.\]35\[.\]99:1888/gateway/wwpac3ey\[.\]q23nf * cxbnqdytjgrxutmzawczv\[.\]cg/gateway/0f4m3h8r\[.\]trz19 * jfbcrmphnnikoktsmcpzirlplkwp\[.\]zl/gateway/8pv47lge\[.\]93qfg 6. **Kidkadi.node** * 2ac4f1a2e22c99a823f18dba8ad5aafde0de98966d5534d5af61650d1f47997c * f87b964e6a619cae6bb8852822d70bee93d708da98214e3b2381ff0774ee8e62 * 0e0a094e2d27a0e3583ff528296f784d29e139bed9ba41fdc6788169c83698b4 * 72eb1f7a418def9d64aaadc556f9350d2a8c444eb7ab56fc59324c5d5f4d76f9 * 33bba47346c03968977688bddbdd245210c06fb7686b4dfc78789c70e2a95219 * f9ab9fc5f1e092ace1dcea7610f4643040a85a5385e3eab3c3666bfe09dc8d6b * 90fa0da74389a302edd4cdb641f280bf95b9f73ed7145f0f9c1728c576cfc0df * 1d405b03bc5913b6b43c06550ef0b9b02196b270625e4dc5fa0c37e8a424be25 7. **HookPE.exe** * ded68a8f5d0765740d469c08bd66270097f3474eab92ee1e65ddcdd6d15fca6e ## **Reference** 1. [GachiLoader: Defeating Node.js Malware with API Tracing GachiLoader: Defeating Node.js Malware](https://research.checkpoint.com/2025/gachiloader-node-js-malware-with-api-tracing/) 2. [LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan](https://www.welivesecurity.com/en/eset-research/longnosedgoblin-tries-sniff-out-governmental-affairs-southeast-asia-japan/) 3. [Group Policy overview for Windows Server | Microsoft Learn](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-overview)