> be me
> get dm
> "smelly, i found goop"
> wtf i love goop (malware)
> "My spouses work, a healthcare clinic, has been infected by malware. It arrived as a .rev file"
> lol ok
> download
> look inside
> .rar file named .rev
> ok nbc
> extract content from rar
> control panel applet
> lol is it 2002?
> look inside
> malware written in Go
> spend forever decoding what is goop code or go code
> 8 hours in
> deeply rustled
> Go goop has .svg document inside it
> goop compromises pcs
> uses .svg inside of it
> goop owners steal da emails on pc
> send .svg from goop to other ppls emails
> .svg inside tells ppl to download a .rev file
> goop propagation with social engineering
> neat
> keep bonking
> goop establishes connection with ip address
> 85.192.30.227
> not flagged by AVs
> goop first seen connecting to IP 2026-09-20
> sort of new goop maybe?
> keep bonking goop
> goop talks to ip address in funny way
> confuse me
> goop takes funny talk and determines what to do
> goop is told by ip to do stuff
> have goop transfer / upload files to ip or infected pc
> have goop start processes
> have goop update itself to latest version
> keep bonking
> finally discover the goop
> Dark Caracal a/k/a GoCaracal
> "cyberespionage group associated with Lebanon’s General Directorate of General Security (GDGS) that has historically targeted governments, businesses, journalists, and activists"

god damn lebanon government your malware was a fucking pain in the ass, i actually wanted to blow my fucking brains out a few times, ngl.

also, but your wifes work is being targeted by the lebanese government, prolly a problem idk, good luck on that bro

C2:
85.192.30.227

Dark Caracal (FQOYI_70153.cpl) SHA256:
8df20f4fd964c84bce577b3984bb5c65bccb876707cd9d94934a414bce7d7479