golddragon | 85f6db3a74a4f1a367cc0b60b190c5da56cd0116c1d6a20fd7b51cda8f8948d8

Resubmissions

20/01/2022, 18:23

220120-w1fqmsbafq1

03/11/2021, 12:18

211103-pgmaraahdn1

Sharing

Copy URL Twitter E-mail

General

Target
85f6db3a74a4f1a367cc0b60b190c5da56cd0116c1d6a20fd7b51cda8f8948d8
Size 2.1MB
Sample211103-pgmaraahdn
SHA256 85f6db3a74a4f1a367cc0b60b190c5da56cd0116c1d6a20fd7b51cda8f8948d8
MD5 4d221c328843e34a087aeca964bc19c8
SHA1 0b3451dc09de42eeffb15519a86a5657c954ca09
SHA512 2f1eea7878524fd3a4d3e0ae8df24bdfd37e0bbad5f2651f32e60bd2276c87e58892a5ec05c111d1dab4f83cd357ee7c043a7db2ec72bd7c6e4ebb99e2214665
SSDEEP 24576:OGGfc+UQZJEA619Qv9xSQEOIet00XkEYJcb5pXQ3PB0lBkY91G1h9vUPqk5u6Dy3:OxQA6zet0IgqJGifxiWqE1A
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor golddragon

Malware Config

Signatures

GoldDragon 2021 Stage1 backdoor 1 IoCs

Detect GoldDragon backdoor Stage 1.

backdoor

resource	yara_rule
sample	golddragon_stage1

Golddragon family
golddragon

File Explorer

85f6db3a74a4f1a367cc0b60b190c5da56cd0116c1d6a20fd7b51cda8f8948d8

.dll 2.1MB

85f6db3a74a4f1a367cc0b60b190c5da56cd0116c1d6a20fd7b51cda8f8948d8

IMPHASH c2e52739913f4c6aa78cf11380ab53d3
SHA256 85f6db3a74a4f1a367cc0b60b190c5da56cd0116c1d6a20fd7b51cda8f8948d8
MD5 4d221c328843e34a087aeca964bc19c8
SHA1 0b3451dc09de42eeffb15519a86a5657c954ca09
SHA512 2f1eea7878524fd3a4d3e0ae8df24bdfd37e0bbad5f2651f32e60bd2276c87e58892a5ec05c111d1dab4f83cd357ee7c043a7db2ec72bd7c6e4ebb99e2214665
SSDEEP 24576:OGGfc+UQZJEA619Qv9xSQEOIet00XkEYJcb5pXQ3PB0lBkY91G1h9vUPqk5u6Dy3:OxQA6zet0IgqJGifxiWqE1A
MD5 SHA1 SHA512 SSDEEP

windows x86

GoldDragon 2021 Stage1 backdoor

Detect GoldDragon backdoor Stage 1.

backdoor

Minor OS version

Major OS version

Entry point

41543

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Sleep GetLastError LoadLibraryA GetVersionExA GlobalAlloc GlobalFree CloseHandle RaiseException DecodePointer GetProcAddress VirtualAllocEx DeleteCriticalSection ReadProcessMemory ReadFile GetTempPathA DeleteFileA SetFileAttributesA GetTempFileNameA FindFirstFileW HeapFree FindNextFileW FindClose InitializeCriticalSectionEx HeapSize GetLogicalDriveStringsW FileTimeToSystemTime HeapReAlloc HeapAlloc GetProcessHeap CreateDirectoryW GetCommandLineW GetModuleFileNameW WaitForSingleObject TerminateThread CreateThread CreateProcessW IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection GetSystemDirectoryW WriteConsoleW GetCommandLineA FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage TerminateProcess LCMapStringW SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW InterlockedFlushSList SetLastError RtlUnwind CreateFileW GetFileType ExitProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte WriteFile GetConsoleCP GetConsoleMode GetACP GetStdHandle ReadConsoleW SetStdHandle SetFilePointerEx FlushFileBuffers SetEndOfFile GetFileAttributesExW GetStringTypeW

user32

ShowWindow wsprintfW

shell32

SHGetSpecialFolderPathW SHGetSpecialFolderPathA

shlwapi

StrStrIW PathAppendA StrCmpIW PathFileExistsA PathAppendW PathFindFileNameW StrStrIA PathFileExistsW

advapi32

SystemFunction036

Name

.text

Size

119KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

272B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

648B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.vlizer

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE