> be me
> get dm
> "smelly i found goop"
> wtf i love goop (malware)
> "Our EDR picked up unusual activity on the network. It was flagged as CLOUDHAZE a/k/a UNC7072"
> ok
> gibs files
> literally nothing on CLOUDHAZE
> literally nothing on UNC7072
> listed as primarily targeting healthcare
> crickets
> tf is this goop?
> look inside
> Rust malware
> make quick initial assessment
> say has weird anti-emulation stuff
> be wildly inaccurate
> be a doofus
> post inaccurate information on internet
> prolly shouldnt write about bonking goop at 3am while sleep deprived
> nobody calls me out
> calling myself out rn for being doofus
> resume bonking
> malware only runs when command line arguments passed
> "--check" or "--check-gui"
> if no command line, dies
> ok
> keep looking
> malware has bunch of stuff inside
> deobfuscates stuff inside itself
> dynamically builds C2 domains
> connects to C2 domains via HTTPS
> sends POST
> emulate
> goop does its thing, connects to C2
> authenticates
> radio silence
> operators likely watching and waiting
> goop doesnt automatically deliver more goop
> ok
> keep digging
> goop can accept commands from operator
> create process and redirect I/O
> read files
> likely has campaign ID associated with it internally
> dm goop giver back
> lol r u in healthcare bro?
> "No, I work for a large Oil and Gas company in Europe"
> company v v valuable to EU for strategic reasons since Ukraine Russia conflict
> hmmmm

Chat, I'm absolutely stumped. I have no clue what the actual fuck I'm looking at. I don't know if this state-sponsored malware, or a really dedicated financially motivated Threat Actor who cares deeply about their operational success. State-sponsored malware would align with potential motives for espionage. However, it would also align for a financially motivated Threat Actor who could make immense money if a compromise was successful.

I wish I could allocate more time to bonking this malware, unfortunately more malware needs bonking. Maybe someone else can pick up on this, a colleague, company, some stinky nerd, whoever or whatever.

C2s:
topsmagnificentgrade(.)com
tabbyottercub(.)com
flawlessgradecheered(.)com

Stager:
7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3

Payload:
74aaa6b54133bbb2e77b2ae874e9900a907c269058f798a0a1197288ba1f7124

Unusual strings I don't understand:
- "Caira"
- "GUJONQGNQCLYEYJ"