Gopher Agent

Overview#

Gopher is a lightweight alternative to Beacon, specifically designed for Linux targets. Written in Go, it produces smaller binaries and supports connecting to multiple listeners simultaneously for redundancy.

Supported Platforms#

Communication Protocol#

Gopher communicates exclusively over TCP through the GopherTCP listener.

Key Differences from Beacon#

Multi-Listener Support#

Gopher’s standout feature is multi_listeners: true. A single Gopher agent can be compiled with profiles for multiple GopherTCP listeners. If one listener goes down, the agent automatically falls over to another. This provides operational resilience without deploying multiple agents.

Agent Configuration#

When generating a Gopher payload:

Timing#

• Sleep — Check-in interval in seconds
• Jitter — Random variance percentage
• Kill Date — Auto-termination date
• Working Hours — Operational time window

Build Parameters#

• Target OS — Linux (always)
• Architecture — amd64 or arm64
• Listeners — One or more GopherTCP listeners to connect to

Build Process#

Gopher agents are compiled at runtime by the teamserver:

GOWORK=off CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
    go build -trimpath -ldflags="-s -w" -o <output>

The source code is located in dist/extenders/gopher_agent/src_gopher/. The build process:

1. Embeds the listener profiles into the agent binary
2. Strips debug symbols (-s -w)
3. Removes build paths (-trimpath)
4. Disables CGO for static compilation (CGO_ENABLED=0)

Use Cases#

• Linux servers — Web servers, databases, containers
• Containerized environments — Small footprint fits container constraints
• Redundant C2 — Multi-listener provides built-in failover
• Infrastructure targets — CI/CD pipelines, build servers, cloud instances
• Minimal footprint — When disk space or transfer bandwidth is limited