Malware
GAMYBEAR
GAMYBEAR A software tool developed using the Go programming language.
GAMYBEAR is a Windows malware family.
Background
GAMYBEAR is a Go-based tool whose core role is to receive ("listener"), run ("executor"), and report ("sender") commands, returning results to its control server as BASE64-encoded data over HTTP.
On startup it produces a unique identifier (UUID) and collects basic host details (via "whoami" and "wmic nicconfig where IPEnabled=true get IPAddress"). It then writes a helper file at %APPDATA%\updater.json, storing the control-server URL in JSON (key "update_server") along with other BASE64-encoded fields (keys "uuid", "hostname", and "ip").
While running, it periodically polls the control server (URI "/c2/get_commands/") and expects a JSON reply containing "command" and "arguments" fields; a "Nop" command triggers a 15-second sleep. Once commands finish, the output and related data are BASE64-encoded into a JSON structure (keys "uuid", "command", "output") and posted back to the server at the URI "/c2/command_out/".
Persistence is handled separately by another script during the initial infection, which adds an entry under the registry "Run" key.
Source: Malpedia (Fraunhofer FKIE).