~/f4n6 $ grep -r "Signing Its Own Alibi: Pulling the Live C2 Out of the "Atlas Metric Industries" Go Stealer's Memory" ./investigations/ --include="*.md"
atlas

Signing Its Own Alibi: Pulling the Live C2 Out of the "Atlas Metric Industries" Go Stealer's Memory

Jeff Davies 03 Oct 2026 5 min read
The first detonation gave us nothing. No DNS, no sockets, no drops, no persistence 8.6 MB of Go binary that ran, yawned, and went back to sleep. The lazy verdict is "sandbox-aware stealer." The correct verdict, it turns out, was hiding in a 60 MB minidump: the malware had checked its watch, seen its config expired four days earlier, and decided not to work that day. This is the teardown including the config, the C2, and the fake telemetry loop it uses to look busy.
0:00
/4:43

Atlas Go Stealer

The rig and the rules

All dynamic work ran inside the lab's isolated VMware guest (for710-win10, host-only networking, reverted to the clean snapshot before and after every run), driven through our malbox tooling. Static work (PE forensics, Go build metadata parsing, certificate extraction, capstone disassembly against the Go pclntab) happened on the lab host. Where a claim comes only from the minidump, we say so.

Stage 0: the archive

4d8efc4528dd...9265d4.zip — AES-encrypted, password infected, one file named after its own SHA-256:

4d8efc4528dd2088d72c68fa693ea22a2fc5946820aab9745ed77f85fa9265d4.exe
  PE32+ executable (GUI) x86-64, 9 sections, 8,618,944 bytes
  imphash c2d457ad8ac36fc9f18d45bffcd450c2

Nine sections is a Go tell: .text, .rdata, .data, .pdata, .xdata, .idata, .reloc plus .symtab (Go symbol table, which saved this analysis) and a single-icon .rsrc. No version info. Timestamp zeroed. Imports collapse to one library kernel32.dll, 47 functions, all Go runtime plumbing. A Windows program that imports nothing else is a Go program, full stop.

The build diary survived anyway (observed, from the Go buildinfo blob):

go1.22.1
path    AtlasMetricIndustries
mod     AtlasMetricIndustries   (devel)
build   -trimpath=true CGO_ENABLED=0 GOARCH=amd64 GOOS=windows

Every main.* function wears a garble-mangled name (main.aKJwW0xm7m5XJQ, main.kcYUB88i5fQZ7) and the string literals are encrypted grepping the binary for Login Data or wallet names returns nothing. The Go pclntab gave us all 67 main.* functions with addresses; the largest, main.ubwyQ, is a single 615 KB blob. Eight of them call syscall.(*LazyProc).Call Windows APIs resolved by name at runtime instead of imported, which is why the static import table is so clean.

The masquerade

Two artifacts make this binary look like corporate correspondence (observed):

  1. The icon a 103×256 DIB rendering as an invoice/document marked "ATLAS METRIC INDUSTRIES" with a barcode footer.
  2. The certificate Authenticode signer C=US, O=Atlas Metric Industries, self-signed on 2026-09-25, chained to nothing but dressed with a legitimate DigiCert timestamp so the block looks notarized. VirusTotal tags the file invalid-signature, which is the polite way of saying the signature is a costume.

No stolen cert, no reseller — just a fictional company, stamped consistently across icon, signature, and Go module path.

Atlas Icon

Detonation one: the silence

Launched under malbox's agent with process/network/drop monitoring (observed): the sample ran, spawned nothing, resolved no DNS, touched no network, dropped nothing, persisted nowhere. Process list: exactly the guest baseline.

A stealer that steals nothing looks broken. We initially read it as VM-awareness. That was wrong and the corrected reading is the interesting part.

The minidump that talked

Round two: launch the sample with stdout/stderr redirected to files, wait 60 seconds, then rundll32 comsvcs.dll,MiniDump <pid> full.dmp full — a full-memory dump of the live process, captured before the malware could notice anything. Two things fell out immediately.

First: the process never stops talking to the wrong audience

85 KB of stderr in sixty seconds (observed):

Relay chatter guard - mode detected:
Mode gust value: 12
Stride buckets (mode count):
Bucket 0
XXX.......
Bucket 1
XXX.......
Bucket 2
XXXXXXXX..
Bucket 3
XXX.......
[repeat forever]

This is decoy telemetry: fake "network relay monitor" output in an endless loop, written to the console the whole time the payload is quietly deciding whether to work. If a user notices the window, they see something that looks like a network diagnostics agent. It's also a builder fingerprint grepping any unknown sample for Relay chatter guard ties it to this toolchain instantly.

Second: the config, decrypted, complete

Go's runtime prints to fd 2 and allocates on the heap; the minidump holds both. From the dump (observed):

tag=be756b1f332c02d411d9cf15b3d6a9d5&exp=1790654626&hwid=d47bcbcb696dbd5b3090b6c77e7479ad
http://nexssbs.sbs:9932/videos
http://nexssbs.sbs:9932/videos-3-89
BsT92kZXLoBe
<BaseNamedObjects>\be756b1f332c02d411d9cf15b3d6a9d5
Mozilla/5.0 (...) Chrome/117.0.0.0 Safari/537.36

Decode it:

  • C2 gate: http://nexssbs[.]sbs:9932/videos — exfil via HTTP POST, Content-Type: application/x-www-form-urlencoded (the header sits next to the URL in the heap, alongside a literal POST). A variant path /videos-3-89 suggests per-build gate numbering.
  • The POST body is staged in memory tag=...&exp=...&hwid=... with exp=1790654626.
  • exp = 2026-09-29 04:03:46 UTC. Our detonations ran October 2–3. The config was already expired. That's the whole mystery: the sample decrypts its config, computes its hardware ID, builds the beacon body and then checks the clock and refuses to send. Not sandbox-evasion. Config-expiry gating a cheap way to burn infrastructure and outlast analysis windows.
  • The campaign tag doubles as the mutex (\BaseNamedObjects\be756b1f...) a single-instance guard that doubles as a campaign identifier. The tag is the same 32-hex string in the POST body.
  • BsT92kZXLoBe a 12-character mixed-case string parked next to the config in the Go heap; most plausibly a build key for the config decryption or beacon authentication. Static-only analysis never sees it, because it only exists after decryption.
  • hwid is per-victim: our guest's value (d47bcbcb...) is derived from its MachineGuid (e1660c52-3c23-497d-93da-8b5df15afa62, visible in the dump's crypto structures) we tested plain MD5 of the GUID and several casing variants; the derivation is more involved than that, but the input is confirmed.
  • The spoofed user agent is Chrome/117.0.0.0.

And the infrastructure checks out

nexssbs[.]sbs registered 2026-09-28 through NameSilo (DNSowl nameservers), pointing at 147[.]182[.]203[.]222 (Hetzner), WHOIS modified 2026-10-03 the day of this analysis. The certificate (Sep 25), the domain (Sep 28), the config build (~Sep 28–29), and the delivery (Oct 2) form a one-week infrastructure stand-up. The config's own expiry barely 24–48 hours after the build is the same burn-fast philosophy applied to the payload itself.

Why the "silent stealer" reading matters

If we'd stopped at round one, this sample would be filed as "VM-aware, config unrecoverable." The corrected story is more useful to defenders:

  • A silent detonation is not proof of evasion. Check the malware's own clock. A minidump of the live process at 60 seconds no debugger attached, no injection recovered the complete config, the staged POST body, the mutex, and the key string. comsvcs.dll needs nothing but the PID.
  • The exp gate is huntable. Any sample from this builder with a fresher config will beacon to the same gate pattern; infrastructure persists (the A record changed today), so block-and-watch beats block-and-forget.
  • The decoy loop is a signature. Relay chatter guard in any process's output = this builder, regardless of sample.

Hunting recipe

  • Block: nexssbs[.]sbs, 147[.]182[.]203[.]222, both gate URLs. Sweep DNS/proxy history back to 2026-09-28.
  • Block the sample: SHA-256 4d8efc4528dd...9265d4, SHA-1 2d7f716b..., MD5 ebe14cc7...; hunt imphash c2d457ad8ac36fc9f18d45bffcd450c2 among unsigned Go PE32+ binaries with .symtab.
  • Cert-based: any binary signed by the self-signed Atlas Metric Industries certificate (serial D860F600678953B13FC2971EE44EE615) issuer equals subject, chain to nothing.
  • Decoy-based: processes emitting repeated "Relay chatter guard" blocks.
  • Delivery: password-protected ZIP (infected) containing a 64-hex-named EXE.

IOCs (defanged)

SHA-256: 4d8efc4528dd2088d72c68fa693ea22a2fc5946820aab9745ed77f85fa9265d4
SHA-1:   2d7f716b6e06a5a76e22d45e1622c44c10aa05c0
MD5:     ebe14cc775229b3fc11ca51fc65d4500
imphash: c2d457ad8ac36fc9f18d45bffcd450c2
Domain:  nexssbs[.]sbs  (A: 147[.]182[.]203[.]222, Hetzner, reg 2026-09-28 NameSilo)
URLs:    hxxp://nexssbs[.]sbs:9932/videos
         hxxp://nexssbs[.]sbs:9932/videos-3-89
Tag:     be756b1f332c02d411d9cf15b3d6a9d5 (also mutex \BaseNamedObjects\<tag>)
Key:     BsT92kZXLoBe
Cert:    C=US, O=Atlas Metric Industries, serial D860F600678953B13FC2971EE44EE615
Post this to LinkedIn
Formatting is converted automatically — headings, bullets, a link back & hashtags. Paste straight in.
J
Jeff Davies