golddragon | 1324acd1f720055e7941b39949116dfe72ce2e7792e70128f69e228eb48b0821 | Triage

Submit
Reports

Overview

overview

Static

static

1

0cc0aa5877...72.exe

windows7-x64

0cc0aa5877...72.exe

windows10-2004-x64

Sharing

General

Target

0cc0aa5877cec9109b7a5a0e3a250c72.bin
Size

513KB
Sample

230412-bk51dagf28
MD5

0cc0aa5877cec9109b7a5a0e3a250c72
SHA1

1d49d462a11a00d8ac9608e49f055961bf79980d
SHA256

1324acd1f720055e7941b39949116dfe72ce2e7792e70128f69e228eb48b0821
SHA512

642b0d06755c78658c308167cf9e61a0e42bb792c61306c6f6976c5ebc51cbce1f795b534e4767e8106edc68bd58f16943c7acc0846cf1c67161c67c28746637
SSDEEP

12288:B/P+NYgHizBSWMJ/17sM57k0+iQkB86PGjg:BO6gH8UJ/mMWkBCg

Score

10^/10

golddragon backdoor persistence spyware stealer

Static task

static1

Behavioral task

behavioral1

Sample

0cc0aa5877cec9109b7a5a0e3a250c72.exe

Resource

win7-20230220-en

golddragon backdoor persistence spyware stealer

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

0cc0aa5877cec9109b7a5a0e3a250c72.exe

Resource

win10v2004-20230221-en

golddragon backdoor persistence spyware stealer

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  0cc0aa5877cec9109b7a5a0e3a250c72.bin
- Size
  
  513KB
- MD5
  
  0cc0aa5877cec9109b7a5a0e3a250c72
- SHA1
  
  1d49d462a11a00d8ac9608e49f055961bf79980d
- SHA256
  
  1324acd1f720055e7941b39949116dfe72ce2e7792e70128f69e228eb48b0821
- SHA512
  
  642b0d06755c78658c308167cf9e61a0e42bb792c61306c6f6976c5ebc51cbce1f795b534e4767e8106edc68bd58f16943c7acc0846cf1c67161c67c28746637
- SSDEEP
  
  12288:B/P+NYgHizBSWMJ/17sM57k0+iQkB86PGjg:BO6gH8UJ/mMWkBCg
Score

10^/10

golddragon backdoor persistence spyware stealer
- GoldDragon
  GoldDragon is a second-stage backdoor attributed to Kimsuky.
  backdoor golddragon
- GoldDragon 2021 Stage1 backdoor
  Detect GoldDragon backdoor Stage 1.
  backdoor
- GoldDragon 2021 Stage2 infostealer
  Detect GoldDragon InfoStealer Stage 2.
  stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Process Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

golddragonbackdoorpersistencespywarestealer

behavioral2

golddragonbackdoorpersistencespywarestealer

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.