golddragon | 5e3907e9e2ed8ff12bb4e96b52401d871526c5ed502d2149dd4f680da4925590

Resubmissions

20/01/2022, 18:23

220120-w1n21sbaf61

03/11/2021, 12:18

211103-pgmaradga41

Sharing

Copy URL Twitter E-mail

General

Target
5e3907e9e2ed8ff12bb4e96b52401d871526c5ed502d2149dd4f680da4925590
Size 2.3MB
Sample211103-pgmaradga4
SHA256 5e3907e9e2ed8ff12bb4e96b52401d871526c5ed502d2149dd4f680da4925590
MD5 8edfa086de4dfdc93c0551bbb08cd5a8
SHA1 4b1b5bed35bc676e835de14ee033339d37f4549d
SHA512 c91371d98116c58c9f2728e53079708e423145da9e25384b9e5d69efa3a3c29614bde40eec66cb38c33a12c42bf9074af8d7f29fccc4974ad3d5e871aef89385
SSDEEP 24576:SdimFPqIwKa4vP8up7Exb5gczxXBvGvo/8vgH1LYZE7sAEsYt7RlPIUhjneH1Y3:SdiIwKtnYxVHzksYJJ8YFC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor golddragon

Malware Config

Signatures

GoldDragon 2021 Stage1 backdoor 1 IoCs

Detect GoldDragon backdoor Stage 1.

backdoor

resource	yara_rule
sample	golddragon_stage1

Golddragon family
golddragon

File Explorer

5e3907e9e2ed8ff12bb4e96b52401d871526c5ed502d2149dd4f680da4925590

.dll 2.3MB

5e3907e9e2ed8ff12bb4e96b52401d871526c5ed502d2149dd4f680da4925590

IMPHASH 6cfc78e272a5312f54fe96bcd75731b5
SHA256 5e3907e9e2ed8ff12bb4e96b52401d871526c5ed502d2149dd4f680da4925590
MD5 8edfa086de4dfdc93c0551bbb08cd5a8
SHA1 4b1b5bed35bc676e835de14ee033339d37f4549d
SHA512 c91371d98116c58c9f2728e53079708e423145da9e25384b9e5d69efa3a3c29614bde40eec66cb38c33a12c42bf9074af8d7f29fccc4974ad3d5e871aef89385
SSDEEP 24576:SdimFPqIwKa4vP8up7Exb5gczxXBvGvo/8vgH1LYZE7sAEsYt7RlPIUhjneH1Y3:SdiIwKtnYxVHzksYJJ8YFC
MD5 SHA1 SHA512 SSDEEP

windows x86

GoldDragon 2021 Stage1 backdoor

Detect GoldDragon backdoor Stage 1.

backdoor

Minor OS version

Major OS version

Entry point

40113

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA RaiseException DecodePointer GetProcAddress DeleteCriticalSection TerminateProcess Sleep GetVersionExA GlobalAlloc GlobalFree CloseHandle VirtualAllocEx ReadProcessMemory ReadFile GetTempPathA DeleteFileA SetFileAttributesA GetTempFileNameA FindFirstFileW HeapFree FindNextFileW FindClose GetLastError HeapSize GetLogicalDriveStringsW FileTimeToSystemTime HeapReAlloc HeapAlloc GetProcessHeap CreateDirectoryW GetCommandLineW GetModuleFileNameW WaitForSingleObject TerminateThread CreateThread CreateProcessW IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection GetSystemDirectoryW WriteConsoleW GetStringTypeW GetCommandLineA FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage InitializeCriticalSectionEx SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW InterlockedFlushSList SetLastError RtlUnwind CreateFileW GetFileType ExitProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte WriteFile GetConsoleCP GetConsoleMode GetACP GetStdHandle ReadConsoleW SetFilePointerEx FlushFileBuffers SetStdHandle SetEndOfFile GetFileAttributesExW LCMapStringW

user32

wsprintfW ShowWindow

shell32

SHGetSpecialFolderPathW SHGetSpecialFolderPathA

shlwapi

PathAppendA PathFindFileNameW StrStrIA PathFileExistsW PathAppendW StrCmpIW StrStrIW

advapi32

SystemFunction036

Name

.text

Size

118KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

272B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

262KB

Virtual Size

262KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.vlizer

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE