Someone sent me some goop (malware) that was directed toward their organization.

This goop is stinkier than your traditional goop. I've been bonking it for awhile now and it's pretty interesting.

This goop does all sorts of sanity checks on the machine, testing various CPU instructions, to ensure it's not being emulated. So far it has successfully evaded emulation from every public facing sandbox.

This is not your run-of-the-mill goop I see in the wild. It has an extremely low-detection rate (literally zero detections right now) from static analysis, dynamic analysis, and emulation.

It also does some payload mutations, has (what appears to be) manual re-implementations of JSON handling (parsing, construction, serialization, deserializing), and even has some weird options for a command-line variant and a GUI variant. It is also more painful because they decided to write it in Rust.

It has functionality for reading files, copying data, executing processes, ... but due to it's pretty intense anti-emulation stuff I can't seem to get it to run, so I'm stuck poking it with a really big stick and yelling at it.

The cherry on top is that I am aware some of my colleagues (who I won't diss) are aware of this particular strain of goop but have not shared explicit details on it. No public write-ups exist and details are extremely limited. It appears (as of this writing) only two or three companies are willing to even briefly whisper about it publicly.

I can't tell if this is state-sponsored espionage goop, or sophisticated financially motivated threat goop who care deeply about their operational success