Static task
static1
Behavioral task
behavioral1
Sample
285714ff750fe1b3343593b2efb7fc3e8229e755c128759faedc5654deae879a.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
285714ff750fe1b3343593b2efb7fc3e8229e755c128759faedc5654deae879a.exe
Resource
win10v2004-en-20220112
General
-
Target
285714ff750fe1b3343593b2efb7fc3e8229e755c128759faedc5654deae879a
-
Size
514KB
-
MD5
42117d18cd9f8597533fee5ad530564f
-
SHA1
21045213f9ed383467ca9596107fe6df96fcc845
-
SHA256
285714ff750fe1b3343593b2efb7fc3e8229e755c128759faedc5654deae879a
-
SHA512
faa3575de6d0fcad608500cf7fdc2eead49990095cf4a4730c9332faeb56fac58d76bd229437ca83c476d658717839edff4a52c3bf3c083e32e2b67bbbc941e1
-
SSDEEP
12288:BLmC9t1dhP0EX4dlD/Ega/4rP8cuYwqoy+TAQQnBgFLJ5p:B/txKO/4rPn+qWTALBeL/p
Malware Config
Signatures
-
GoldenSpy Payload 1 IoCs
Processes:
resource yara_rule sample goldenspy_svm_payload -
Goldenspy family
Files
-
285714ff750fe1b3343593b2efb7fc3e8229e755c128759faedc5654deae879a.exe windows x86
956f822862c383939a39c0436c3a9836
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentThreadId
ReleaseMutex
ReadFile
IsDBCSLeadByteEx
WriteFile
CreateFileW
MultiByteToWideChar
GetFileSize
WideCharToMultiByte
WaitForSingleObject
LoadLibraryW
UnregisterWaitEx
QueryDepthSList
CreateMutexA
GetTickCount
GetVersionExA
WinExec
GetProcessHeap
HeapAlloc
CloseHandle
Process32Next
GetLastError
Sleep
CreateToolhelp32Snapshot
OpenProcess
TerminateProcess
GetCurrentProcess
HeapFree
Process32First
DeleteFileA
GetTempPathA
FindClose
FindNextFileA
FindFirstFileA
GetModuleFileNameA
GetLocalTime
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualProtect
VirtualAlloc
GetVersionExW
GetModuleHandleA
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
CreateTimerQueue
SetEndOfFile
HeapSize
WriteConsoleW
FlushFileBuffers
HeapReAlloc
SetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
TryEnterCriticalSection
DuplicateHandle
SwitchToThread
GetCurrentThread
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
QueryPerformanceFrequency
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlUnwind
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
GetCommandLineA
GetCommandLineW
GetACP
CreateThread
ExitThread
FreeLibraryAndExitThread
GetFileType
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileAttributesExW
GetTimeZoneInformation
FindFirstFileExA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
user32
GetSystemMetrics
advapi32
RegQueryInfoKeyA
RegCreateKeyA
DeregisterEventSource
CreateServiceA
StartServiceCtrlDispatcherA
CloseServiceHandle
SetServiceStatus
RegisterServiceCtrlHandlerA
OpenSCManagerA
DeleteService
ControlService
StartServiceA
ReportEventA
ChangeServiceConfig2A
OpenServiceA
RegisterEventSourceA
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
ole32
CoCreateGuid
CoUninitialize
CoInitialize
psapi
GetModuleFileNameExA
wininet
HttpAddRequestHeadersA
HttpEndRequestA
InternetWriteFile
InternetReadFile
HttpSendRequestExA
HttpSendRequestA
InternetCloseHandle
InternetOpenA
InternetSetOptionA
HttpOpenRequestA
HttpQueryInfoA
InternetConnectA
Sections
.text Size: 367KB - Virtual size: 366KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 113KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ