goproxy | ee34aa5e5e490d6a31fa3474c02c3d942fc725656b7e469d0f9ad49a64f1172f[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ee34aa5e5e490d6a31fa3474c02c3d942fc725656b7e469d0f9ad49a64f1172f.exe
Size 6.4MB
Sample260305-ep3mlab12q
SHA256 ee34aa5e5e490d6a31fa3474c02c3d942fc725656b7e469d0f9ad49a64f1172f
MD5 2ee2eff62d0d3631dd27a3dc45ed3809
SHA1 96f9dad1077eb27e362677359c8a75043dd62222
SHA512 7afa004a570d4ea142ff86f1fc78e7e9013d89622891f4557796bab8fa7a9e9a79d82b4249b766ac8a79e339a0d6429c1d71817cf0396b1576489ea0082773f2
SSDEEP 49152:CIld0fxaVaGMtmqmj+bN3rwKltXvmRUtaHcTIRkAm4pQR5QW4gM3zJj3cj0BrCUG:CAwt9LscukAPMrkZukbcEn5g
TLSH
T1EB664A03ECA155E9C0BAE2318A639252BB717C895F3123D32B90F7292F76BD06E75750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

goproxy

Malware Config

Signatures

Detects GoProxy payload 1 IoCs

resource	yara_rule
sample	family_goproxy

Goproxy family
goproxy

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
ee34aa5e5e490d6a31fa3474c02c3d942fc725656b7e469d0f9ad49a64f1172f.exe

File Explorer

ee34aa5e5e490d6a31fa3474c02c3d942fc725656b7e469d0f9ad49a64f1172f.exe

.exe 6.4MB

ee34aa5e5e490d6a31fa3474c02c3d942fc725656b7e469d0f9ad49a64f1172f.exe

IMPHASH d42595b695fc008ef2c56aabd8efd68e
SHA256 ee34aa5e5e490d6a31fa3474c02c3d942fc725656b7e469d0f9ad49a64f1172f
MD5 2ee2eff62d0d3631dd27a3dc45ed3809
SHA1 96f9dad1077eb27e362677359c8a75043dd62222
SHA512 7afa004a570d4ea142ff86f1fc78e7e9013d89622891f4557796bab8fa7a9e9a79d82b4249b766ac8a79e339a0d6429c1d71817cf0396b1576489ea0082773f2
SSDEEP 49152:CIld0fxaVaGMtmqmj+bN3rwKltXvmRUtaHcTIRkAm4pQR5QW4gM3zJj3cj0BrCUG:CAwt9LscukAPMrkZukbcEn5g
TLSH
T1EB664A03ECA155E9C0BAE2318A639252BB717C895F3123D32B90F7292F76BD06E75750
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects GoProxy payload
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

a5:7d:8d:3e:7a:b4:f6:ea:5f:b5:0f:1a:ac:ec:87:e4:c9:23:90:c7:a5:01:5f:71:32:1b:02:cd:c9:94:f8:b6

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=94349,CN=Telegram FZ-LLC,O=Telegram FZ-LLC,L=Dubai,ST=Dubai,C=AE,1.2.840.113549.1.9.1=#0c11696e666f4074656c656772616d2e6f7267,1.3.6.1.4.1.311.60.2.1.2=#13054475626169,1.3.6.1.4.1.311.60.2.1.3=#13024145,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Dec 5, 2025

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

5d:1f:24:a6:0a:e1:a2:75:11:d8:86:25

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 17, 2025 - Apr 17, 2028

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

509056

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

346KB

Virtual Size

690KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

704B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

ee34aa5e5e490d6a31fa3474c02c3d942fc725656b7e469d0f9ad49a64f1172f.exe

PE Signature issue

kernel32

generic