golddragon | 85f6db3a74a4f1a367cc0b60b190c5da56cd0116c1d6a20fd7b51cda8f8948d8

Resubmissions

20-01-2022 18:23

220120-w1fqmsbafq 1

03-11-2021 12:18

211103-pgmaraahdn 10

Sharing

Copy URL

Twitter E-mail

General

Target

85f6db3a74a4f1a367cc0b60b190c5da56cd0116c1d6a20fd7b51cda8f8948d8
Size

2.1MB
MD5

4d221c328843e34a087aeca964bc19c8
SHA1

0b3451dc09de42eeffb15519a86a5657c954ca09
SHA256

85f6db3a74a4f1a367cc0b60b190c5da56cd0116c1d6a20fd7b51cda8f8948d8
SHA512

2f1eea7878524fd3a4d3e0ae8df24bdfd37e0bbad5f2651f32e60bd2276c87e58892a5ec05c111d1dab4f83cd357ee7c043a7db2ec72bd7c6e4ebb99e2214665
SSDEEP

24576:OGGfc+UQZJEA619Qv9xSQEOIet00XkEYJcb5pXQ3PB0lBkY91G1h9vUPqk5u6Dy3:OxQA6zet0IgqJGifxiWqE1A

Score

10^/10

backdoor golddragon

Malware Config

Signatures

GoldDragon 2021 Stage1 backdoor 1 IoCs
Detect GoldDragon backdoor Stage 1.
backdoor

Processes:

resource yara_rule

sample golddragon_stage1
Golddragon family
golddragon

resource	yara_rule
sample	golddragon_stage1

Files

85f6db3a74a4f1a367cc0b60b190c5da56cd0116c1d6a20fd7b51cda8f8948d8
.dll windows x86

c2e52739913f4c6aa78cf11380ab53d3

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
GetLastError
LoadLibraryA
GetVersionExA
GlobalAlloc
GlobalFree
CloseHandle
RaiseException
DecodePointer
GetProcAddress
VirtualAllocEx
DeleteCriticalSection
ReadProcessMemory
ReadFile
GetTempPathA
DeleteFileA
SetFileAttributesA
GetTempFileNameA
FindFirstFileW
HeapFree
FindNextFileW
FindClose
InitializeCriticalSectionEx
HeapSize
GetLogicalDriveStringsW
FileTimeToSystemTime
HeapReAlloc
HeapAlloc
GetProcessHeap
CreateDirectoryW
GetCommandLineW
GetModuleFileNameW
WaitForSingleObject
TerminateThread
CreateThread
CreateProcessW
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
GetSystemDirectoryW
WriteConsoleW
GetCommandLineA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
TerminateProcess
LCMapStringW
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
InterlockedFlushSList
SetLastError
RtlUnwind
CreateFileW
GetFileType
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
WriteFile
GetConsoleCP
GetConsoleMode
GetACP
GetStdHandle
ReadConsoleW
SetStdHandle
SetFilePointerEx
FlushFileBuffers
SetEndOfFile
GetFileAttributesExW
GetStringTypeW

user32

ShowWindow
wsprintfW

shell32

SHGetSpecialFolderPathW
SHGetSpecialFolderPathA

shlwapi

StrStrIW
PathAppendA
StrCmpIW
PathFileExistsA
PathAppendW
PathFindFileNameW
StrStrIA
PathFileExistsW

advapi32

SystemFunction036

Exports

Exports

Run

Sections

.text
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vlizer
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Resubmissions

Sharing

General

Malware Config

Signatures

Files

c2e52739913f4c6aa78cf11380ab53d3

Code Sign

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

shlwapi

advapi32

Exports

Exports

Sections

.text Size: 119KB - Virtual size: 119KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 7KB - Virtual size: 10KB

.tls Size: 512B - Virtual size: 9B

.gfids Size: 512B - Virtual size: 272B

.rsrc Size: 1024B - Virtual size: 648B

.reloc Size: 6KB - Virtual size: 5KB

.vlizer Size: 1.9MB - Virtual size: 1.9MB

.text
Size: 119KB - Virtual size: 119KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 7KB - Virtual size: 10KB

.tls
Size: 512B - Virtual size: 9B

.gfids
Size: 512B - Virtual size: 272B

.rsrc
Size: 1024B - Virtual size: 648B

.reloc
Size: 6KB - Virtual size: 5KB

.vlizer
Size: 1.9MB - Virtual size: 1.9MB