Overview

overview

10

Static

static

10

1d30dfa5d8...d6.dll

windows7-x64

10

1d30dfa5d8...d6.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1d30dfa5d8f21d1465409b207115ded6.bin

  • Size

    948KB

  • Sample

    230412-bxb8tsac9v

  • MD5

    1d30dfa5d8f21d1465409b207115ded6

  • SHA1

    942fd7b4ef1ccf7032a40acad975c7b5905c3c77

  • SHA256

    ed0161f2a3337af5e27a84bea85fb4abe35654f5de22bcb8a503d537952b1e8a

  • SHA512

    743b9e97336b07e3fde5511328488db212b1d7fac73152cef6253ddee1da3ee9764919eb2672caa0ffa258c79d37044f478afa6040d19ab822fc850e374fc646

  • SSDEEP

    12288:Xk39Tm0nUOM1rlFZs4pw60ev9cdPw7lu73ATUUyLafJVtnMB8UltPh:CHUOM1hFZlZ9YPeu73AA6Jbne80

Score
10/10
golddragonbackdoorpersistencespywarestealer

Malware Config

Targets

    • Target

      1d30dfa5d8f21d1465409b207115ded6.bin

    • Size

      948KB

    • MD5

      1d30dfa5d8f21d1465409b207115ded6

    • SHA1

      942fd7b4ef1ccf7032a40acad975c7b5905c3c77

    • SHA256

      ed0161f2a3337af5e27a84bea85fb4abe35654f5de22bcb8a503d537952b1e8a

    • SHA512

      743b9e97336b07e3fde5511328488db212b1d7fac73152cef6253ddee1da3ee9764919eb2672caa0ffa258c79d37044f478afa6040d19ab822fc850e374fc646

    • SSDEEP

      12288:Xk39Tm0nUOM1rlFZs4pw60ev9cdPw7lu73ATUUyLafJVtnMB8UltPh:CHUOM1hFZlZ9YPeu73AA6Jbne80

    Score
    10/10
    golddragonbackdoorpersistencespywarestealer

    • GoldDragon

      GoldDragon is a second-stage backdoor attributed to Kimsuky.

      backdoorgolddragon

    • GoldDragon 2021 Stage1 backdoor

      Detect GoldDragon backdoor Stage 1.

      backdoor

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks