GoonHUB[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
GoonHUB.exe
Size 27.0MB
Sample260801-wsf2faeg26
SHA256 d26e929339b80f1b00775958443377007c40071e7dbc18b39e255f412548adff
MD5 da97b4c0527a1120b068b0947e0939b7
SHA1 bda3933c76a14e821798991902cc8d9b030e0aa8
SHA512 bdeffc57ca8d312cab576b763f29681ecbcac3fedb787889aaca317fe80f4b81fd1ff33cb97447b8018037af98cd9c520c0ec0e920c4b8b64829ab0b5d76b996
SSDEEP 196608:o5wsHb2nGy7ptRxxQ+Wmlz7MOGjSsOspTLqTPRpJwpDXFrzU:zs76GyFQO17+jnOUSzJI7+
TLSH
T127572522620C751590A3BA3C9E3341D377BCEE45DEB4CAE5B9CAF90BDA5B34215B0364
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GoonHUB.exe

File Explorer

GoonHUB.exe

.exe 27.0MB

GoonHUB.exe

IMPHASH 09e91a6d05d9f2af7ea143d5e1363163
SHA256 d26e929339b80f1b00775958443377007c40071e7dbc18b39e255f412548adff
MD5 da97b4c0527a1120b068b0947e0939b7
SHA1 bda3933c76a14e821798991902cc8d9b030e0aa8
SHA512 bdeffc57ca8d312cab576b763f29681ecbcac3fedb787889aaca317fe80f4b81fd1ff33cb97447b8018037af98cd9c520c0ec0e920c4b8b64829ab0b5d76b996
SSDEEP 196608:o5wsHb2nGy7ptRxxQ+Wmlz7MOGjSsOspTLqTPRpJwpDXFrzU:zs76GyFQO17+jnOUSzJI7+
TLSH
T127572522620C751590A3BA3C9E3341D377BCEE45DEB4CAE5B9CAF90BDA5B34215B0364
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

310592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

recv connect socket WSACleanup closesocket getaddrinfo WSAStartup send freeaddrinfo

winhttp

WinHttpSendRequest WinHttpConnect WinHttpCloseHandle WinHttpReceiveResponse WinHttpOpen WinHttpOpenRequest WinHttpSetOption

kernel32

GetCommandLineW FindNextFileW FindFirstFileExW FindClose GetOEMCP GetACP IsValidCodePage GetModuleFileNameA Process32First SetPriorityClass GetCurrentProcess WriteFile TerminateProcess CreateMutexA WaitForSingleObject UnmapViewOfFile OpenProcess GetCommandLineA CreateToolhelp32Snapshot Sleep GetTempPathA CopyFileA GetLastError OpenMutexA MoveFileExA QueryFullProcessImageNameA GetEnvironmentStringsW DeleteFileA Process32Next CloseHandle SetFileAttributesA CreateFileMappingA WTSGetActiveConsoleSessionId ExitProcess GetCurrentProcessId CreateProcessA CreateDirectoryA MapViewOfFile GetLogicalProcessorInformation OpenFileMappingA VirtualAlloc VirtualProtect VirtualFree GetLargePageMinimum HeapQueryInformation HeapSize HeapReAlloc ReadConsoleW GetTimeZoneInformation ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW SetEndOfFile WriteConsoleW CreateFileA IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW HeapFree HeapAlloc GetFileType SetFilePointerEx GetFileSizeEx WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread GetLogicalProcessorInformationEx QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime RtlUnwind WideCharToMultiByte ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetProcAddress GetModuleFileNameW GetStdHandle RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter

user32

SetProcessDPIAware FindWindowA GetForegroundWindow GetDesktopWindow GetShellWindow GetWindowThreadProcessId

shell32

SHGetFolderPathA ShellExecuteExA

advapi32

AdjustTokenPrivileges CreateProcessAsUserA SetTokenInformation AllocateAndInitializeSid LookupPrivilegeValueA OpenProcessToken FreeSid CheckTokenMembership DuplicateTokenEx

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

secur32

DeleteSecurityContext AcquireCredentialsHandleA InitializeSecurityContextA QueryContextAttributesA ApplyControlToken FreeContextBuffer FreeCredentialsHandle DecryptMessage EncryptMessage

Name

.text

Size

486KB

Virtual Size

485KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

26.5MB

Virtual Size

26.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_TEXT_JI

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

GoonHUB.exe

ws2_32

winhttp

kernel32

user32

shell32

advapi32

wtsapi32

userenv

secur32

generic