← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
The Golden Tax Department and Emergence of GoldenSpy Malware
Trustwave SpiderLabs, during a recent threat hunting engagement, discovered a Chinese cyber threat targeting corporations operating in China. This report details the attack methodology, suspected entities behind the activity, and protective measures to mitigate risk of being impacted. The following series of events detail the threat.
MITRE ATT&CK & Malware Families
Indicators of Compromise (21 / 84 total)
| TYPE | INDICATOR | DESCRIPTION | CREATED | |
|---|---|---|---|---|
| FileHash-MD5 | 77b8787a1bcda6e18c42c1855d2f1fa0 | MD5 of 98b5320e7464fc69b12eb626b6336604efcbf6502adc38c77f6db41666da9dd1 | 2020-06-26 | |
| FileHash-MD5 | 09b4079b039d13b47944e4cc7182f96f | MD5 of 41103f32f247ba744a8fbe17deac4bd26aeba323f3161e44adc35f8dd81ce4d3 | 2020-06-26 | |
| FileHash-MD5 | 5002cc2fbcdd2f340e9258f74be8bd1d | MD5 of a6e9d6c145668c4fc6e6dbd3d1fe4bc394211d9c09d31c12730ceddf3e5056be | 2020-06-26 | |
| FileHash-MD5 | b363e855f613233848a0a89216488bfb | MD5 of 20932b2151de5f0dc5c1159fbc1d2d004f069bb04d32d66dc7fa5b7b9eac1aa7 | 2020-06-26 | |
| FileHash-MD5 | 4fc56dd3b3875cda5708451f756426b3 | MD5 of c5c5e59bb18bad1427714d0007b676e658d8e08faf5a0632ed88912f5816d525 | 2020-06-26 | |
| FileHash-MD5 | e104c1deefaf379787677fcdc2ec3efc | MD5 of 77ee7b0a10f3c0ab08c1b1f88ceb0dd979e9c2fee17ac5fd14c9ce27002f6078 | 2020-06-26 | |
| FileHash-MD5 | 1ff67f9f87638321ee19bd79ce5820d4 | MD5 of f21623311a947d8a9f2dd05c098f45c3ef12be3cbf79fb49659e5bfc1588cdfe | 2020-06-26 | |
| FileHash-MD5 | f136481347008770f882e63e76690ae0 | MD5 of b67913449618756dcc815a242a270257cce4d5ae71911bb6716bdecc2f1c0c7f | 2020-06-26 | |
| FileHash-MD5 | f27d1590ba0aaad5d3c0831cf3e33df6 | MD5 of 4f86175e5500be87cc95ea9fcaf565970e15a86b2aa3223f8ef8d25e72cec376 | 2020-06-26 | |
| FileHash-MD5 | edadf30df18e6a7ea190041cf3bd4a0b | MD5 of 3b8761d2e19bc5185f55cc2f575bbe54a45a52fc1c8650a60f1bd13e01e24655 | 2020-06-26 | |
| FileHash-MD5 | 27d448f9d2bed761e15541c55b5966f2 | — | 2020-07-14 | |
| FileHash-MD5 | 471c75acc284396354c89616f9030718 | — | 2020-07-14 | |
| FileHash-MD5 | 26e71f1d387298162c1b19e858d001a1 | — | 2020-07-14 | |
| FileHash-MD5 | 40a84b78944235850690c7873924282e | — | 2020-07-14 | |
| FileHash-MD5 | bee06d785b7e51a0127a96c5854d4345 | — | 2020-07-14 | |
| FileHash-MD5 | 61eed90b1ae70244cd87a3abd3ec622a | — | 2020-07-14 | |
| FileHash-MD5 | 682a0826db8572bad205a4db12005e13 | — | 2020-07-14 | |
| FileHash-MD5 | 490d17a5b016f3abc14cc57f955b49b3 | — | 2020-07-14 | |
| FileHash-MD5 | d312336fd46972a544929d0dc4e07b83 | — | 2020-07-14 | |
| FileHash-MD5 | fbb35e8f16e7d5a735f06ae03e8bfaac | — | 2020-07-14 | |
| FileHash-MD5 | 9e2ebdbc9ba4dca69a712e3268f3ab77 | — | 2020-07-14 |
References (4)
↗ https://trustwave.azureedge.net/media/16908/the-golden-tax-department-and-emergence-of-goldenspy-malware.pdf
↗ https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/goldenspy-chapter-4-goldenhelper-malware-embedded-in-official-golden-tax-software/#_Toc45185607
↗ https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/goldenspy-chapter-3-new-and-improved-uninstaller/
↗ https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/goldenspy-chapter-two-the-uninstaller/