GoldDragon

GoldDragon is a second-stage backdoor attributed to Kimsuky.

suricata: ET MALWARE Windows TaskList Microsoft Windows DOS prompt command exit OUTBOUND

suricata: ET MALWARE Windows TaskList Microsoft Windows DOS prompt command exit OUTBOUND

suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND

Blocklisted process makes network request

Executes dropped EXE

VMProtect packed file

Detects executables packed with VMProtect commercial packer.