goproxy | 157879b573e2d2b14931dc28fd58941694bc10bdae9c6b785755b056334564e1

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/03/2026, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-03-01_54be6ae28bafeb4e681492fead5ab4fc_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 6.2MB
Sample260301-cf6lsaf15b
SHA256 157879b573e2d2b14931dc28fd58941694bc10bdae9c6b785755b056334564e1
MD5 54be6ae28bafeb4e681492fead5ab4fc
SHA1 301f1941cde1d6dc3ded2327889a4b8c6349fa0e
SHA512 d508c4e6c268e9d285d722765f321d37bf16ed0c0fde6692f9d10702505fd3f9b46c0368eb6f13190cbb2b8ce58f85f784b28c7078df6c2140a9c3f5973eaddf
SSDEEP 49152:x5LGu0XFTWTz3+5GyGoaKNo4FSov0HvLptrtN3TpKHaNPIUKTrg0ybqj5mY9N5Uj:xlGW3yxYvttrt1xN4fyu/EbsE
TLSH
T12E663903EDA155E9C0AAE23185639153BAB17C485F3523D72BA0F7382F72BD0AE79750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor goproxy persistence

Malware Config

Signatures

Detects GoProxy payload 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000243ed-1.dat	family_goproxy

GoProxy
GoProxy is a proxy malware written in Golang.
backdoor goproxy
Goproxy family
goproxy

Executes dropped EXE 1 IoCs

pid	Process
2044	realtekaudio.exe

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	4	Go-http-client/1.1
HTTP User-Agent header	23	Go-http-client/1.1

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-03-01_54be6ae28bafeb4e681492fead5ab4fc_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-03-01_54be6ae28bafeb4e681492fead5ab4fc_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
PID:5468

C:\ProgramData\Realtek\realtekaudio.exe
C:\ProgramData\Realtek\realtekaudio.exe
1⤵
- Executes dropped EXE
PID:2044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

realtekaudio.exe

Path C:\ProgramData\Realtek\realtekaudio.exe
Size 6.2MB
SHA256 de71dfc44a55fd7cf9d7b0f2c306b0779bbfcf7e7e0c5a88baf1990fd7ea7272
MD5 a9f9a15eddbc94a5642f9e0ad9c0e9cf
SHA1 2e9e9fd159f5c7ea34814b3850fee64eaece254e
SHA512 590d5d326a693e0ff09a55e8fa3ff8d41960190b1a50d16e4308c58b3425a4d91389280c8cc57ac420153f359dcbe214d112802a5e216fd0819ed88d592f19c6
SSDEEP 49152:i5LGu0XFTWTz3+5GyGoaKNo4FSov0HvLptrtN3TpKHaNPIUKTrg0ybqj5mY9N5Uj:ilGW3yxYvttrt1xN4fyu/EbsE
TLSH
T146663903EDA155E9C0AAE23185639153BAB17C485F3523D72BA0F7382F72BD0AE79750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download