> Family · uniqfile_

~/packetpursuit $ cat /intel/families/uniqfile.md

typeentityconfidencelowcreated2026-06-17updated2026-06-17malware-familypecompilergolangsigningevasiondownloader

uniqfile

OpenCTI label uniq.file assigned to at least 8 PE samples in this corpus (SHA prefixes: 056f7a2e, 368ce352, 8297ec78, a1943a9a, d65f14e5, dc65030a, e4315252, e79a525e). All carry the co-label dropped-by-gcleaner. The samples are heterogeneous in architecture, size, and build toolchain, indicating uniqfile is likely an umbrella tag or distribution-batch label rather than a single malware family with shared code lineage.

Build Stack

The best-characterized sample (a1943a9a) is:

  • Go 1.18.5, CGO_ENABLED=0, GOARCH=amd64, GOOS=windows
  • Randomized module path (vFsFeEitfcsqNDz) — anti-reputation / anti-triage
  • Authenticode-signed with short-lived R12 intermediate cert CN=starkvillesd.com
  • No .rsrc section; no embedded icons, manifests, or version-info masquerade
  • Standard Go Windows syscall surface (kernel32.dll only, 42 imports)

Other uniqfile-tagged samples include x86 and x64 PEs with 5–11 sections and sizes ranging from ~400 KB to ~5 MB — no consistent compiler fingerprint across the set.

Deployment / TTPs

  • Distribution: All observed samples transit via the gcleaner multi-payload dropper / bundler infrastructure.
  • Static C2: None recovered. Hardcoded network indicators, credential paths, or wallet addresses are absent in the analysed sample. Any C2 is either runtime-decrypted or delivered as a second stage.
  • Anti-analysis: No VM detection, no debugger checks, no process hollowing visible statically. The primary evasion is opacity: signed outer binary with no observable malicious strings.
  • Attribution: The starkvillesd.com certificate has not been observed on other corpus samples. Low-confidence attribution to any named actor.

Notable Analyses

  • gcleaner — umbrella distribution label; all uniqfile samples are co-labeled dropped-by-gcleaner.

Capabilities

  • go-1.18-pe64-signed-dropper
  • mingw-w64-pe32-rdata-encrypted-loader
  • xor-rolling-key-decryption
  • anti-emulation-sleep-clock-gate
  • reflective-pe-loader-heap
  • runtime-c2-resolution
  • zero-static-ioc-outer-binary
  • gcleaner-distribution
  • version-info-masquerade

References

  • OpenCTI label: uniq.file / dropped-by-gcleaner
  • MalwareBazaar: u tag (shorthand for uniq.file in this corpus context)
  • Sample e79a525e analysis: /intel/analyses/e79a525e7677dfa422e529c390adb02c6250edb0e22f0666e3e7302ff27d8348.html