Overview

overview

10

Static

static

7

c066b81c4b...92.dll

windows7-x64

10

c066b81c4b...92.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c066b81c4b8b0703f81f8bc6fb432992.bin

  • Size

    272KB

  • Sample

    230412-es4n3abc5z

  • MD5

    c066b81c4b8b0703f81f8bc6fb432992

  • SHA1

    2508f5ff0c28356c0c3f8e6cae7b750d53495bca

  • SHA256

    63b4bd01f80d43576c279adf69a5582129e81cc4adbd03675909581643765ea8

  • SHA512

    b0b847f1c0fe52b0c32af9a0708ac0c6584cb151d6640dbed61d7842bc7cfa70e7aca5e2d324677095ad416fe9fd14f73056ff01620f0f3919cf4d3c82bb6bc2

  • SSDEEP

    6144:SrrUrTgMun07ApvXb3K9W9RqL6io/O64azPFyR1I6nGBvY:SrgPpa07Apj3+W9RqL4/hbFyIfY

Score
10/10
golddragonbackdoorvmprotect

Malware Config

Targets

    • Target

      c066b81c4b8b0703f81f8bc6fb432992.bin

    • Size

      272KB

    • MD5

      c066b81c4b8b0703f81f8bc6fb432992

    • SHA1

      2508f5ff0c28356c0c3f8e6cae7b750d53495bca

    • SHA256

      63b4bd01f80d43576c279adf69a5582129e81cc4adbd03675909581643765ea8

    • SHA512

      b0b847f1c0fe52b0c32af9a0708ac0c6584cb151d6640dbed61d7842bc7cfa70e7aca5e2d324677095ad416fe9fd14f73056ff01620f0f3919cf4d3c82bb6bc2

    • SSDEEP

      6144:SrrUrTgMun07ApvXb3K9W9RqL6io/O64azPFyR1I6nGBvY:SrgPpa07Apj3+W9RqL4/hbFyIfY

    Score
    10/10
    golddragonbackdoorvmprotect

    • GoldDragon

      GoldDragon is a second-stage backdoor attributed to Kimsuky.

      backdoorgolddragon

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks