goproxy | 61e1e044b392607e2e74b6e3bcab4a8d6e16ebe60bd014fb9f292968e77e05fb

Sharing

Copy URL Twitter E-mail

General

Target
61e1e044b392607e2e74b6e3bcab4a8d6e16ebe60bd014fb9f292968e77e05fb
Size 6.2MB
Sample260305-dk2n3aav7p
SHA256 61e1e044b392607e2e74b6e3bcab4a8d6e16ebe60bd014fb9f292968e77e05fb
MD5 dc034cab0b68a2646b823a02a4fc44ce
SHA1 806a2049de5dc0076b48533346e28e7c554d7dc8
SHA512 7031ee554c81a7dd30e9332c7aa3fd6bdb539b535ff4e9a8602d30f32c8612314851a032b73bf158d857b75c38bebda8e19aae491cd79ebddd038b86ba35e0cc
SSDEEP 49152:Mxt73VyXCC1Q14JLzXHF09KNURnhWrq5F5WzFAukNZkLIeJjhy9w5eofK7K9Kvs3:MnQDBV0RncrqzINOKLI7efmsxg3Ep
TLSH
T145664A03ECA555E9C0AAE23189779152BBB17C485B3523D72BA0F3386F72BD06E79350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

goproxy

Malware Config

Signatures

Detects GoProxy payload 1 IoCs

resource	yara_rule
sample	family_goproxy

Goproxy family
goproxy

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
61e1e044b392607e2e74b6e3bcab4a8d6e16ebe60bd014fb9f292968e77e05fb

File Explorer

61e1e044b392607e2e74b6e3bcab4a8d6e16ebe60bd014fb9f292968e77e05fb

.exe 6.2MB

61e1e044b392607e2e74b6e3bcab4a8d6e16ebe60bd014fb9f292968e77e05fb

IMPHASH d42595b695fc008ef2c56aabd8efd68e
SHA256 61e1e044b392607e2e74b6e3bcab4a8d6e16ebe60bd014fb9f292968e77e05fb
MD5 dc034cab0b68a2646b823a02a4fc44ce
SHA1 806a2049de5dc0076b48533346e28e7c554d7dc8
SHA512 7031ee554c81a7dd30e9332c7aa3fd6bdb539b535ff4e9a8602d30f32c8612314851a032b73bf158d857b75c38bebda8e19aae491cd79ebddd038b86ba35e0cc
SSDEEP 49152:Mxt73VyXCC1Q14JLzXHF09KNURnhWrq5F5WzFAukNZkLIeJjhy9w5eofK7K9Kvs3:MnQDBV0RncrqzINOKLI7efmsxg3Ep
TLSH
T145664A03ECA555E9C0AAE23189779152BBB17C485B3523D72BA0F3386F72BD06E79350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects GoProxy payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

508288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

346KB

Virtual Size

690KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

832B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

61e1e044b392607e2e74b6e3bcab4a8d6e16ebe60bd014fb9f292968e77e05fb

kernel32

generic