Written in Go, GoldMax acts as command-and-control backdoor for the actor. The malware writes an encrypted configuration file to disk, where the file name and AES-256 cipher keys are unique per implant and based on environmental variables and information about the network where it is running