Edit tour
Windows
Analysis Report
lDO4WBEQyL.exe
Overview
General Information
| Sample name: | lDO4WBEQyL.exerenamed because original name is a hash value |
| Original sample name: | 43142552e4812e3337226ca1664ed728.exe |
| Analysis ID: | 1583035 |
| MD5: | 43142552e4812e3337226ca1664ed728 |
| SHA1: | 8c1806c454beb91cc24fec69ca8e26c560790d6e |
| SHA256: | d08de75b76be3596cbcb6fa6f0c39bd41cd876d29cec1108990856989d6ed0f9 |
| Tags: | exeuser-abuse_ch |
| Infos: |   |
 | |
Detection
GO Backdoor
| Score: | 88 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected GO Backdoor
AI detected suspicious sample
Found Tor onion address
Machine Learning detection for sample
Suspicious powershell command line found
Abnormal high CPU Usage
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected non-DNS traffic on DNS port
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Classification
- System is w10x64
lDO4WBEQyL.exe (PID: 7328 cmdline: "C:\Users\ user\Deskt op\lDO4WBE QyL.exe" MD5: 43142552E4812E3337226CA1664ED728) 
powershell.exe (PID: 7940 cmdline: powershell -WindowSt yle hidden -Command "if (-Not (Test-Path \"HKCU:\\ Software\\ Microsoft\ \Windows\\ CurrentVer sion\\Run\ \App\")) { Set-ItemP roperty -P ath \"HKCU :\\Softwar e\\Microso ft\\Window s\\Current Version\\R un\" -Name \"App\" - Value \"C: \Users\use r\Desktop\ lDO4WBEQyL .exe\" }" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) 
conhost.exe (PID: 7948 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- lDO4WBEQyL.exe (PID: 8188 cmdline:
"C:\Users\ user\Deskt op\lDO4WBE QyL.exe" MD5: 43142552E4812E3337226CA1664ED728) - powershell.exe (PID: 5232 cmdline:
powershell -WindowSt yle hidden -Command "if (-Not (Test-Path \"HKCU:\\ Software\\ Microsoft\ \Windows\\ CurrentVer sion\\Run\ \App\")) { Set-ItemP roperty -P ath \"HKCU :\\Softwar e\\Microso ft\\Window s\\Current Version\\R un\" -Name \"App\" - Value \"C: \Users\use r\Desktop\ lDO4WBEQyL .exe\" }" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) - conhost.exe (PID: 1972 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- lDO4WBEQyL.exe (PID: 2920 cmdline:
"C:\Users\ user\Deskt op\lDO4WBE QyL.exe" MD5: 43142552E4812E3337226CA1664ED728)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_GOBackdoor | Yara detected GO Backdoor | Joe Security |
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): | ||
| Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): | ||
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-01T17:02:44.876620+0100 | 2855536 | 1 | A Network Trojan was detected | 192.168.2.5 | 59227 | 185.157.213.253 | 22132 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-01T17:03:14.288230+0100 | 2855537 | 1 | A Network Trojan was detected | 192.168.2.5 | 59227 | 185.157.213.253 | 22132 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-01T17:03:14.460470+0100 | 2855538 | 1 | A Network Trojan was detected | 185.157.213.253 | 22132 | 192.168.2.5 | 59227 | TCP |
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-01T17:02:44.862102+0100 | 2855539 | 1 | A Network Trojan was detected | 185.157.213.253 | 22132 | 192.168.2.5 | 59227 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
Networking | |
|---|
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | Suricata IDS: | ||
| Source: | String found in binary or memory: | ||