General

  • Target

    40e90ed12cc044253fea43fe89390fe6fbed08ce8c67acbe9d904ea67ceffd0f

  • Size

    15.5MB

  • MD5

    4752dab5fbf31223a6a2bfd6b8a99a47

  • SHA1

    de8683c9f560827fa50b842604d865d2d31d1cfb

  • SHA256

    40e90ed12cc044253fea43fe89390fe6fbed08ce8c67acbe9d904ea67ceffd0f

  • SHA512

    a96a207202e593ffc3217b3eb43f7f43fb07910a59825c0961bd482c709502e8a4277774cbcf98eb6b0c393614143e9db313e5e6d8337ee498b27976b9cc241d

  • SSDEEP

    393216:yJZjLiIy2W1SCOFEjA3y0WCjhR6cnxgxqhMDJPJQp8zORSm:+ByLsTf3jhLgxl3QkMSm

Score
8/10
upx

Malware Config

Signatures

  • Detects GOST tunneling tool 1 IoCs

    A simple tunneling tool written in Golang

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unsigned PE 22 IoCs

    Checks for missing Authenticode signature.

Files

  • 40e90ed12cc044253fea43fe89390fe6fbed08ce8c67acbe9d904ea67ceffd0f
    .zip
  • GW/DynamicData.dll
    .dll windows:4 windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • GW/ICSharpCode.SharpZipLib.dll
    .dll windows:4 windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • GW/INIFileParser.dll
    .dll windows:4 windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • GW/Interop.TaskScheduler.dll
    .dll windows:4 windows x64

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • GW/Microsoft.WindowsAPICodePack.Shell.dll
    .dll windows:4 windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • GW/Microsoft.WindowsAPICodePack.dll
    .dll windows:4 windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • GW/NetchLib.dll
    .dll windows:4 windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • GW/Newtonsoft.Json.dll
    .dll windows:4 windows x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • GW/ReactiveUI.Winforms.dll
    .dll windows:4 windows x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • GW/ReactiveUI.dll
    .dll windows:4 windows x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • GW/Splat.dll
    .dll windows:4 windows x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • GW/System.Buffers.dll
    .dll windows:4 windows x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • GW/System.Reactive.dll
    .dll windows:4 windows x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • GW/System.Runtime.CompilerServices.Unsafe.dll
    .dll windows:4 windows x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • GW/System.Threading.Tasks.Extensions.dll
    .dll windows:4 windows x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • GW/System.ValueTuple.dll
    .dll windows:4 windows x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • GW/Telescope.exe
    .exe windows:4 windows x64


    Headers

    Sections

  • GW/Telescope/libsscrypto.dll
    .dll windows:6 windows x64

    5d34552f4e93524c8581dbcbe0064dbf


    Headers

    Imports

    Exports

    Sections

  • GW/bin/NTT.exe
    .exe windows:4 windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • GW/bin/NetchCore.dll
    .dll windows:6 windows x64

    0d6d5ccb6e23035a00d7f1488cce2876


    Headers

    Imports

    Exports

    Sections

  • GW/bin/Privoxy.exe
    .exe windows:4 windows x86


    Headers

    Sections

  • GW/bin/ShadowsocksR.exe
    .exe windows:4 windows x64

    5ef55f47a0ed40a7f8947818d4f3f247


    Headers

    Imports

    Sections

  • GW/bin/Win-10.sys
    .sys windows:6 windows x64

    c089b867a4b799a2ece4dca0900e084b


    Code Sign

    Headers

    Imports

    Sections

  • GW/bin/Win-7.sys
    .sys windows:6 windows x64

    22602cf9c9696e7b40d9844e9d493520


    Code Sign

    Headers

    Imports

    Sections

  • GW/bin/Win-8.sys
    .sys windows:6 windows x64

    c089b867a4b799a2ece4dca0900e084b


    Code Sign

    Headers

    Imports

    Sections

  • GW/bin/ck-client.exe
    .exe windows:6 windows x64

    f0070935b15a909b9dc00be7997e6112


    Headers

    Imports

    Sections

  • GW/bin/default.acl
  • GW/bin/default.conf
  • GW/bin/dns2tcp.exe
    .exe windows:4 windows x64

    4c29cdb5454b7c93470bd2a417089a8a


    Headers

    Imports

    Sections

  • GW/bin/gost.exe
    .exe windows:6 windows x64

    65892a964106b5e0c6c363fdf21975eb


    Headers

    Imports

    Sections

  • GW/bin/nfapi.dll
    .dll windows:6 windows x64

    5728c90b74457950666147b0a19f4364


    Headers

    Imports

    Exports

    Sections

  • GW/bin/sysproxy.dll
    .dll windows:6 windows x64

    dd84a1f65d5ceac7d7c9cdf7a7c591c2


    Headers

    Imports

    Exports

    Sections

  • GW/bin/tap-driver/OemVista.inf
  • GW/bin/tap-driver/OemWin2k.inf
  • GW/bin/tap-driver/install.bat
  • GW/bin/tap-driver/tap0901.cat
  • GW/bin/tap-driver/tap0901.sys
    .sys windows:6 windows x64

    a13cebc938af36dab20cc614c6fb7e94


    Headers

    Imports

    Sections

  • GW/bin/tap-driver/tapinstall.exe
    .exe windows:6 windows x64

    4dedaf984510c806d325f29e45ab7ae3


    Headers

    Imports

    Sections

  • GW/bin/tun2socks.exe
    .exe windows:6 windows x64

    ad4c63f24ec3ca95074247b2321f7b45


    Headers

    Imports

    Exports

    Sections

  • GW/bin/vcruntime140.dll
    .dll windows:6 windows x64

    33da3684eb6a5f91c8d92da28927c116


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • GW/data/default_server.acl
  • GW/data/privoxy.conf
  • GW/data/settings.json
  • GW/i18n/zh-TW
  • GW/logging/application.log
  • GW/mode/A Hat in Time.txt
  • GW/mode/AMD Radeon.txt
  • GW/mode/ARK -TX- (TUN-TAP).txt
  • GW/mode/Adobe Creative Cloud (No Apps).txt
  • GW/mode/Apex Legends (with Origin).txt
  • GW/mode/Arma3.txt
  • GW/mode/Battlefield 1.txt
  • GW/mode/Battlefield 3.txt
  • GW/mode/Battlefield 4.txt
  • GW/mode/Battlefield V -TX- (TUN-TAP).txt
  • GW/mode/Battlefield V.txt
  • GW/mode/Battlenet.txt
  • GW/mode/Blockstorm.txt
  • GW/mode/Bypass LAN (Socks5 + HTTP) (Non System Proxy).txt
  • GW/mode/Bypass LAN (Socks5) (Non System Proxy).txt
  • GW/mode/Bypass LAN (TUN-TAP).txt
  • GW/mode/Bypass LAN and China (Socks5 + HTTP) (Non System Proxy).txt
  • GW/mode/Bypass LAN and China (Socks5) (Non System Proxy).txt
  • GW/mode/Bypass LAN and China (TUN-TAP).txt
  • GW/mode/Bypass LAN and China.txt
  • GW/mode/Bypass LAN.txt
  • GW/mode/Call of Duty ModernWarfare.txt
  • GW/mode/Counter-Strike - Global Offensive.txt
  • GW/mode/Cube 2 Sauerbraten.txt
  • GW/mode/CyberDuck.txt
  • GW/mode/DOOM Eternal (TUN-TAP).txt
  • GW/mode/DOOM Eternal.txt
  • GW/mode/DOOM.txt
  • GW/mode/Dead by Daylight -TX- (TUN-TAP).txt
  • GW/mode/Destiny 2 .txt
  • GW/mode/Dino D-Day.txt
  • GW/mode/Discord.txt
  • GW/mode/EVE Online -TX- (TUN-TAP).txt
  • GW/mode/EVE Online.txt
  • GW/mode/Etterna.txt
  • GW/mode/FINAL FANTASY XIV Online.txt
  • GW/mode/Faceit AC.txt
  • GW/mode/Factorio.txt
  • GW/mode/For The King.txt
  • GW/mode/Fortnite.txt
  • GW/mode/Forza Horizon 4 -TX- (TUN-TAP).txt
  • GW/mode/Forza Motorsport 7 -TX- (TUN-TAP).txt
  • GW/mode/ForzaHorizon 4.txt
  • GW/mode/Geforce Experience.txt
  • GW/mode/Git.txt
  • GW/mode/Grand Theft Auto V -TX- (TUN-TAP).txt
  • GW/mode/Grand Theft Auto V.txt
  • GW/mode/Hitman 2.txt
  • GW/mode/Insurgency Sandstorm.txt
  • GW/mode/JetBrains ToolBox.txt
  • GW/mode/Killing Floor 2.txt
  • GW/mode/League of Legends (Japan) (with Riot Games).txt
  • GW/mode/League of Legends (Taiwan) (with Garena).txt
  • GW/mode/League of Legends (US).txt
  • GW/mode/Left 4 Dead 2.txt
  • GW/mode/Minecraft (Java).txt
  • GW/mode/Minecraft Bedrock (Win10 UWP).txt
  • GW/mode/Move or Die.txt
  • GW/mode/NatTypeTester.txt
  • GW/mode/Natural Selection 2.txt
  • GW/mode/Nine Parchments.txt
  • GW/mode/NodeJS With NVM.txt
  • GW/mode/OSU.txt
  • GW/mode/Origin.txt
  • GW/mode/PlayerUnknown's Battlegrounds - Test Server.txt
  • GW/mode/PlayerUnknown's Battlegrounds -TX- (TUN-TAP).txt
  • GW/mode/PlayerUnknown's Battlegrounds Lite.txt
  • GW/mode/PlayerUnknown's Battlegrounds.txt
  • GW/mode/PowerShell.txt
  • GW/mode/Quake Champions.txt
  • GW/mode/Quake Live.txt
  • GW/mode/Rising Storm 2 Vietnam.txt
  • GW/mode/Rockstar Games Launcher.txt
  • GW/mode/Sourcetree.txt
  • GW/mode/Squad.txt
  • GW/mode/Steam.txt
  • GW/mode/Steep.txt
  • GW/mode/Stick Fight The Game.txt
  • GW/mode/Tannenberg.txt
  • GW/mode/The Division 2 -TX- (TUN-TAP).txt
  • GW/mode/Tom Clancy's Rainbow Six Siege (with Uplay).txt
  • GW/mode/Tom Clancy's Rainbow Six Siege (without Uplay).txt
  • GW/mode/Tom Clancy's The Division 2 (with Uplay).txt
  • GW/mode/Tom Clancy's The Division 2 (without Uplay).txt
  • GW/mode/UNO (with Uplay).txt
  • GW/mode/UNO (without Uplay).txt
  • GW/mode/Ultimate Chicken Horse.txt
  • GW/mode/Unity Asset Store for Unity.txt
  • GW/mode/Unity Hub.txt
  • GW/mode/Uplay.txt
  • GW/mode/Verdun.txt
  • GW/mode/Visual Studio Code.txt
  • GW/mode/Warframe.txt
  • GW/mode/Warthunder.txt
  • GW/mode/Watch_Dogs 2 (with Uplay).txt
  • GW/mode/Watch_Dogs 2 (without Uplay).txt
  • GW/mode/Xftp 6.txt
  • GW/mode/Xshell 6.txt
  • GW/mode/overcooked! 2.txt
  • GW/mode/qBittorrent.txt
  • GW/nfapinet.dll
    .dll windows:4 windows x64


    Headers

    Exports

    Sections

  • GW/picture/ae.png
    .png
  • GW/picture/ar.png
    .png
  • GW/picture/au.png
    .jpg
  • GW/picture/az.png
    .png
  • GW/picture/bg.png
    .png
  • GW/picture/br.png
    .png
  • GW/picture/ca.png
    .jpg
  • GW/picture/ch.png
    .png
  • GW/picture/cl.png
    .png
  • GW/picture/cn.png
    .png
  • GW/picture/cr.png
    .png
  • GW/picture/cz.png
    .png
  • GW/picture/de.png
    .png
  • GW/picture/ee.png
    .png
  • GW/picture/es.png
    .png
  • GW/picture/fi.png
    .png
  • GW/picture/fr.png
    .png
  • GW/picture/gb.png
    .jpg
  • GW/picture/gr.png
    .png
  • GW/picture/hk.png
    .png
  • GW/picture/hr.png
    .png
  • GW/picture/hu.png
    .png
  • GW/picture/id.png
    .png
  • GW/picture/ie.png
    .png
  • GW/picture/il.png
    .png
  • GW/picture/in.png
    .gif
  • GW/picture/ir.png
    .png
  • GW/picture/is.png
    .png
  • GW/picture/it.png
    .png
  • GW/picture/jp.png
    .jpg
  • GW/picture/kh.png
    .png
  • GW/picture/kp.png
    .png
  • GW/picture/kr.png
    .jpg
  • GW/picture/kz.png
    .png
  • GW/picture/lt.png
    .png
  • GW/picture/lv.png
    .png
  • GW/picture/md.png
    .png
  • GW/picture/my.png
    .png
  • GW/picture/ng.png
    .png
  • GW/picture/nl.png
    .jpg
  • GW/picture/ph.png
    .jpg
  • GW/picture/pl.png
    .png
  • GW/picture/pt.png
    .png
  • GW/picture/ro.png
    .png
  • GW/picture/ru.png
    .png
  • GW/picture/sa.png
    .png
  • GW/picture/se.png
    .png
  • GW/picture/sg.png
    .png
  • GW/picture/sk.png
    .png
  • GW/picture/th.png
    .png
  • GW/picture/tr.png
    .png
  • GW/picture/tw.png
    .png
  • GW/picture/ua.png
    .png
  • GW/picture/us.png
    .jpg
  • GW/picture/vn.png
    .png