Goldun Downloader - PrivacyAnywhere Spyware Research Library


	Home / Research


	Goldun

Details of the Goldun are shown below. This threat can be detected and cleaned using PestBlock Anti-Spyware.


Name:	Goldun
Type:	Downloader
Risk:
Description:	Trojan.Goldun is a hidden process that steals personal information such as usernames and passwords for financial accounts. It then sends this data to a remote server located at sturfajtn.com.

Removal
We do not publish here the MD5 checksums for files. PestBlock Anti Spyware can identify good file from bad more accurately.

Running Processes:

up.exe
00000000c.exe$
00000000c.exe$
00000000c.exe$
024383a4c.exe$
058f9484c.exe$
0799629c.exe
07ecd32ec.exe$
0986b8aec.exe$
0f9b50cf.exe
1231231.exe
1983a8e8.exe
25102005.exe
2c3ed79cc.exe$
2c6ade2e.exe
3.exe
30168569.exe
31153005c.exe$
3261ddd5.exe
37ee7e8a.exe
3be5b8b1c.exe$
3f159f85c.exe$
569bd79b.exe
5a6fbecdc.exe$
5f01c224c.exe$
641dda90.exe
6663aacf.exe
6f2863c3.exe
744d013bc.exe$
796f6620.exe
83857182.exe
89202884.exe
8d8a652e.exe
9281c7d6.exe
9d184628c.exe$
9e28e21b.exe
a460ee6ec.exe$
a894477bc.exe$
aca1196bc.exe$
aff9706fc.exe$
b2641feac.exe$
be78492ec.exe$
c4a4d17dc.exe$
c8a7e8e4c.exe$
d3e35da8c.exe$
d6cb55ebc.exe$
db38a1ffc.exe$
dc5a1a10c.exe$
ebd033bcc.exe$
f5da023ec.exe$
f7a9aaf1c.exe$
ffb4d524c.exe$
a22a476e.exe
a6ffa3b4.exe
bfde72dc.exe
cd8aa829.exe
e02eeb4a.exe
e487dfbe.exe
e5661960.exe
ea61ce20-860c-11d3-a05d-00104b6909d0.exe
eb739c38.exe
f5578ba0.exe
f87d01df.exe
fc7c039e.exe
file1.exe
file1_2.exe
file2.exe
final.exe
next1.exe
ss.exe
svchosò.exe
sys3015.exe
troy.exe
userinit.exe
w32goldun-ab.exe
xexe.exe
xexe.exe
anti.exe1
765f8f03.exe

Files:

systemroot+\system32\docent?.dll
systemroot+\system32\docentd.sys
systemroot+\system32\fiks.exe
systemroot+\system32\svchosò.exe
systemroot+\system32\armdvc.sys
systemroot+\system32\csddriver.sys
systemroot+\system32\gdiw2k.sys
systemroot+\system32\gdiwxp.dll
systemroot+\system32\gdwxp3.dll
systemroot+\system32\ies4dll.dll
systemroot+\system32\ies4service.sys
systemroot+\system32\iesprt.sys
systemroot+\system32\kbdlog.txt
systemroot+\system32\logon032.dll
systemroot+\system32\logon16x.dll
systemroot+\system32\lsd_f3.dll
systemroot+\system32\mcfg7a.dll
systemroot+\system32\mdfpro.dll
systemroot+\system32\mslown.dll
systemroot+\system32\msstuber.dll
systemroot+\system32\msudp4.sys
systemroot+\system32\nodantivir.sys
systemroot+\system32\nuc???.sys
systemroot+\system32\nuc???dll.dll
systemroot+\system32\rege2usb.dll
systemroot+\system32\regepsrvc.sys
systemroot+\system32\satau320.dll
systemroot+\system32\tcpg4t.dll
systemroot+\system32\wmedia16.exe
systemroot+\system32\wnlogon.sys
systemroot+\system32\xcdkernl.sys
%temp%\xexe.exe
logon032.dll
logon16x.dll
logon16x.dll
mcfg7a.dll
msudp4.sys
nuclab.sys
tcpg4t.dll
up.exe
00000000c.$
00000000c.$
00000000c.$
00000000c.$
00000000c.bin$
00000000c.bin$
00000000c.bin$
00000000c.exe$
00000000c.exe$
00000000c.exe$
00000000c.pws$
00268578c.$
006c6967c.$
00750354c.$
008e4e4ec.$
02125262c.bin$
021cb85bc.$
024383a4c.exe$
027c4f97c.$
02d74fbdc.bin$
0300226bc.bin$
041decfac.$
04519854c.$
047ee4b1c.$
0482aac3c.$$$$
04e62b22c.$
051cbc79c.$
05464db8c.$
0552e501c.$
058f9484c.exe$
05d0f4d0c.$
06afb297c.pe_$
06d602a8c.$
0753caf8c.$
0799629c.exe
079e5db6c.$
07ecd32ec.exe$
0808bc77c.$
08719e02c.$
0986b8aec.exe$
0a22e3d9c.ex_$
0af8cfc1c.$
0b26890bc.$
0b3a9c5dc.$
0b3f32d1c.$
0b6bd73ac.$
0b6cec11c.$
0c0b6fc6c.$
0caf0267c.$
0cf8362cc.exw$
0d6443dcc.bin$
0dc12a22c.$
0dd1b425c.$
0dee3c5ac.$
0dfb5590c.$$$
0eb9e129c.spy$
0eedb5bfc.dll$
0eee4f32c.bin$
0f2e554ac.$
0f4c15cdc.bin$
0f5979b4c.$
0f9b50cf.exe
10b43041c.$
10df9562c.$
10f62f16c.$
11207723c.$
1132ad0ec.$
11f288efc.$
1231231.exe
12e9cee9c.$
130ce54ec.$
1353cb94c.$
151f273dc.$
1604d7c7c.$
161dfdc1c.bin$
16e467e8c.$
17527526c.$
17de33a9c.089$
189811cdc.$
18f21d56c.$
192c4fbfc.pe_$
1983a8e8.exe
19eecd22c.$
1a81549bc.bin$
1b2d546ec.$
1b423d38c.$
1b4ad6dec.$
1c660fedc.$
1cee918bc.$
1cffd864c.pe_$
1db24284c.$
1dc43936c.$
1df5607fc.$
1e7a4e63c.$
1ecdce35c.$
1ed3f4a1c.bin$
1f2f7bd8c.$
1f851337c.$
1fef0146c.$
1df925e8.dll
2099f3a7c.$
20b88f6dc.$
20db17aec.$
20fedb00c.vxe$
2110a777c.$
217a3004c.$
21af8701c.pee$
21b87e80c.bin$
222f60f7c.$
229f4818c.$
23b878e3c.$
23e5cb4bc.$
23cff6018a9369cd0f0e15c166c7ae14
24166b65c.$
24ec22f5c.$
25102005.exe
2598cf55c.$
26eb9fccc.$
280ad8aec.$
28246ab1c.bin$
2827bfaac.dll$
28bb8309c.$
28dd184cc.$
29142148c.$
294c6357c.$
29f35548c.$
2a5ac935c.$
2acd41cbc.$
2b3e18e1c.$
2b4ad928c.pe1$
2c023533c.$
2c3ed79cc.exe$
2c6e605dc.$
2df24dcac.$
2dfed00ec.$
2e7a89f3c.$
2e911a3bc.vir$
2f9dca9cc.$
2fac71a7c.$
2c6ade2e.exe
3.exe
30168569.exe
30506a43c.$
3065b83ec.$
306c0750c.$
3071c8c7c.$
30dc1d22c.bin$
30e493c6c.$
30f930fdd9ad61250e91ebc6a1cfe738
31153005c.$
31153005c.exe$
31343759c.$
314873b5c.$
318a3310c.$
31c7d5b6c.$
31ec31dfc.$
31f44575c.rar$
3261ddd5.exe
3286a37ec.$
32916d53c.$
32bba66dc.$
3373111ac.$
337c2bbac.$
338fe3c9c.$
341d5168c.bin$
35a1805ec.dll$
3665f054c.$
36a0b9aec.$
377faaf9c.$
37d4e23cc.$
37d4e23cc.$
37d56e00c.$
37ee7e8a.exe
382167eec.$
38907176c.$
397684e8c.bin$
399463f8c.$
39a28bcac.$
3a16bff6c.$
3a8876eac.$
3be5b8b1c.exe$
3c2b93b9c.sys$
3c388676c.$
3d89cebac.bin$
3d89cebac.bin$
3da034ffc.bin$
3da519eec.$
3e9f6b5bc.$
3ed5c3d3c.$
3f127245c.$
3f127245c.bin$
3f159f85c.exe$
3f522d37c.$
3f74dd6dc.$
3dbcf1d8.dll
400cab16c.$
40aba8c1c.$
410e9bb1c.$
41141787c.$
414bf59ac.$
415f3efcc.$
419be41cc.$
429aae73c.$$$
42b01d23c.$
42fd53ab.dll
4311a866c.bin$
432cac70c.$
432cda75c.$
432f6ddec.$
43903560c.$$$
43f6118ec.$
44d425c7c.$
44d6f99cc.$
44e59762c.bin$
472db293c.$$
47365469c.$$
476d32c9c.cs_$
47afac54c.$
47eb6c1cc.$
47f7545ec.$
4915327bc.bin$
49a452c4c.swf$
4a273367c.$
4a58a61cc.$
4aa4486ec.bin$
4be7fb7ac.$
4beb1529c.$
4c496359c.$
4caed0dec.$
4ce31ae3c.$
4d82cb44c.$
4dacdbccc.$
4ea7e3d2c.$
4f65314dc.$
4f6afb85c.$
4fbba7dac.$
501b6ff0c.$
50c0657ac.$
50d9f3c4c.$
51501856c.$
51646654c.$
518911afc.$
5208762ec.$
522afbd1c.$
52637cc6c.$
5283a301c.exw$
52e838ffc.$
530f5da6.dll
534665f2c.bin$
53871e58c.exw$
5414fddec.$
542dfba9c.$
54b9457bc.$
550db8a2b1dae87edcc297cf7543c27c
5510859ec.$
553aaee9c.$
559db50ec.$
55c81afbc.$
55dd6b94c.$
569bd79b.exe
56fe1b60c.$
576da9b8c.$
57943505c.$
580107dcc.$
5801161fc.$
581289d4c.$
58224b2dc.$
58456e73c.$
588e5364c.$
5913984ac.$
59c26813c.$
59dd70c1c.bin$
59f8a72ac.$
5a2a3fb3c.exw$
5a423daac.pe1$
5a6fbecdc.exe$
5ab7ed13c.bin$
5af14d6fc.$
5b42c9ffc.bin$
5b60641fc.$
5b973609c.$
5c18857ac.$
5d3b9bd1c.$
5d893976c.pe_$
5d99c6d2c.bin$
5da933e5c.$
5e77f21ec.$
5ee8c169c.$
5f01c224c.exe$
5f1fb516c.$
5fddbf97c.$
6070585fac90b0149b699d802ff6149b
6125cacec.$
614450f9c.$
61b1f558c.$$$
61d6350bc.$
629b20a0c.$
62c9513cc.$
62d19681c.$
63327e80c.$
63a2f8eec.$
641dda90.exe
64b2ad33c.$
64bd03b7c.$
65205461c.$
653c1508c.$
6614280dc.$
665f95f7c.$
6663aacf.exe
66eb9e3fc.bin$
6711b767c.$
67642418c.$
689022adc.$
68a6bc23c.$$
68cf3340c.dll$
68ed036dc.$
69008592c.$
69b95689c.$
69bcc36ac.$
6a4fe5f7c.bin$
6a4fe5f7c.bin$
6a64251dc.$
6a7bf0fdc.$
6a91d371c.$
6aa00f12c.$
6ab60c62c.$
6aeb15d4c.dll$
6b5de4f2c.$
6b9a68afc.$
6be6c59cc.$
6c359049c.$
6cb2956ac.$
6ccc59b5c.$
6ce925d4c.dll$
6cf55ae9c.$
6d93d13ac.$
6e631c9bc.$
6e77a78bc.$
6f05993fc.$
6f4d68f0c.$
6fff1a53c.$
6f2863c3.exe
7101dbffc.bin$
71cbeaa2c.$
71f5cb44c.$
72309255c.$
7250f7acc.$
72576660c.$
725a723dc.$
734b2bd2c.$
73b09cedc.$
744d013bc.exe$
74dd6a79c.$
75135297c.c_t$
7528c354c.$
75576eecc.$
7595c90dc.ren$
75977f45c.$
75b202d8c.dll$
75c81718c.$
75cc9acec.$
765956f3c.bin$
766a1801c.$
76c0828fc.$$
771967d6c.$
771e3df6c.dta$
77459333c.$
77515a46c.$
7815756bc.$
788c1228c.$
78bac4d8c.$
79169138.dll
7953ea28c.$
796f6620.exe
7ac24089c.$
7b04697cc.$
7b13b2bbc.bin$
7b28e4c6c.$
7bcc63c4c.$
7cb67a78c.$
7cd001aec.$
7d1f11bdc.$
7dac0b84c.$
7daff0edc.$
7e02d5ccc.$
7e4baad0c.$
7e51ef10c.$
7e53f2a7c.$
7e55f430c.$
7f2a78f0c.$
7f8557d5c.$
7fb11a8fc.$
7fb948e2c.$
7cdafeb1f02c6d96a17dfde8d03225bf
817c27abc.$
81be0c56c.pee$
8233e34dc.$
82434a2ac.bin$
8278c7dac.$
82d84812c.$
833b126bc.$
8352cb03c.bin$
835da798c.$
83857182.exe
83ddab8ec.pe_$
844a121ac.$
84e0ad1bc.$
8541b4a2c.$
8550b24e32ec398ef737dd39947dfe0f
8598f22bc.pe_$
870e5c05.dll
87368533c.$
875a7efac.$
877d129bc.$
87e07c94c.$
88ae46e7c.sys$
88cb4c54c.$
890c7511c.$
89202884.exe
89cad67fc.$
89ef5ff7.dll
8a115f3ec.$
8a330fd0c.$
8a7648b5c.$
8ade1bf2c.$
8af5fb87c.$
8b2299ffc.$
8b597c52c.$
8b6edde4c.$$
8be69f6dc.$
8c199921c.$
8ca29cffc.$
8cb5964cc.$
8d6bb35fc.$
8dc940f8c.$
8ebd3c47c.bin$
8ebed57dc.$
8f450894c.$
8f4d2f63c.$
8d8a652e.exe
8d91fc4f.dll
90c706c1c.$
910c6040c.$
91485808c.$$$$
9172eac0c.$
91dc5beac.rar$
9281c7d6.exe
92aeaa13c.$
9317d38ec.$
931a1977c.$
93719321c.$
93d8a182c.$
93f95388c.$
9515a863c.$
963ca9a3c.$
9646f6dbc.$
96bcc755c.$
96eb10fbc.spy$
96f89fa6c.$
970ca794c.$
97235cf2c.$
974ac090c.$
98333320c.$
988b0164c.$
9897f74cc.$
99038290c.$
993d701ac.$$
9a13cae2c.bin$
9a1b92f8c.$
9adeb361c.$
9b2139a2c.$
9b980dc8c.$
9b9e9718c.sys$
9c35b3cec.$
9c75684dc.bin$
9cbe31ecc.$
9cd1552bc.$
9d0369b8c.$$$$
9d0dfef3c.$
9d1507c0c.$
9d184628c.exe$
9d6b4190c.$
9e19b546c.$
9e2f6ff8c.$
9f2932e6c.$
9f7e0134c.$
9ff17810c.bin$
9e28e21b.exe
a08eaa3ec.$
a0a980f2c.$
a0cecd2ec.$
a14cc9c3c.$
a1cad90dc.$
a226402bc.bin$
a28abe00c.bin$
a2fd9a31c.$
a3527216c.$
a3564047c.bin$
a38ad1d3c.$
a3c8a350c.$
a44c2e91c.pee$
a460ee6ec.exe$
a5f68d4cc.$$$$
a63a2af2c.$
a6621492c.bin$
a680409fc.$
a6e8c763c.rar$
a756fb72c.$
a793b4e2c.$
a823a0e9c.$
a842e973c.pe_$
a88512a7c.$
a894477bc.exe$
a8c87e95c.$
a94eb660c.$
a98a7fecc.$
aa69eb2fc.$$$
aa9bd17dc.bin$
aaa9f12cc.$
ab3f4345c.$
ab6c7946c.$
ab82e764c.$
ab9a485fc.$
abfc193cc.$
ac2cfbb1c.$
ac36a60fc.$
ac53a6ccc.$
ac687ec9c.$
ac8653dfc.$
aca1196bc.exe$
acb7578bc.$
acd217d9c.swf$
acd4b224c.$
ad150513c.$
ad1b4bb5c.bin$
ad9c2b4ac.$
ada42290c.bin$
adba53e2c.$
adc5bf54c.$
ae208bc5c.$
ae810ad0c.$
ae9cda20c.$
aeeac08fc.$
af241c57c.$
af9ce27fc.$
af9f453bc.$
aff9706fc.exe$
b02fa822c.$
b03b176dc.$
b114c841c.$
b139aa8bc.sys$
b13f8386c.$
b2641feac.exe$
b29b3c11c.$
b2cc83f0c.$
b37c6e1dc.$
b3ffe4d6c.$
b4a0a2a4c.pee$
b515edd2c.$
b6b6f9a9c.$
b6dc0f24c.$
b78c1b81c.$
b830c35dc.bin$
b8f83447c.$
ba04d193c.$
ba1e3802c.$
bb3d2770c.$
bbd3b1dcc.bin$
bc10a02dc.$
bd35fae3c.$
bd55dab0c.$
bd7fa5cbc.dll$
bd86e091c.$
bdbd6a3bc.sys$
bdd3ed88c.$
be78492ec.exe$
be8858bbc.$
bea15b5cc.$
befec9fbc.$$
bf345b6fc.$
bffd1430c.$
c018afb2c.$
c0527896c.$
c06069b1c.$
c07de086c.$
c14a0656c.$
c1f61285c.$
c363ac89c.$
c376bad5c.$
c48f92cec.$
c48f92cec.$
c4a4d17dc.exe$
c4da2e23c.pe_$
c53a8b0dc.$
c58d9472c.$
c5bf6fbfc.$
c6152c8bc.$
c6e4f616c.$
c6e790bcc.ex1$
c7460035c.$
c7fbf278c.$
c886093fc.$$$
c8a7e8e4c.exe$
c8b23d12c.$
c8d8791fc.$
c8f0ed2fc.$
c9aa3b2bc.$
ca1f0426c.$
ca3587adc.$
ca45eab8c.exw$
ca55cd34c.$
cae23f28c.$
cb458ed9c.dll$
cc3e7cc0c.$
cd521707c.$
cde5e54ec.$
cdeae103c.$
ce007cfac.$
ce607cdec.$
ce89481bc.bin$
cec90001c.$
cee860cac.$
cef805f3c.$
cf2d2ac4c.$
cfb97748c.$
cffddb91c.$
d008f469c.$
d02c3572c.$
d0c84885c.$
d0fa1793c.$$
d1009642c.$
d104c716c.$
d1366b3dc.$
d27489a5c.bin$
d296f9acc.$
d2b45b56c.bin$
d3e35da8c.exe$
d44c5affc.$
d47041cac.$
d48b13eac.$
d5075328c.$
d54eb462c.$
d5e21474c.$
d636503cc.$
d6cb55ebc.exe$
d6d9e88cc.$
d7284b22c.$
d845ec24c.$
d88891c3c.dll$
d8b6b7e2c.sys$
da2037b6c.$
da7474c5c.$
db191a64c.$
db25d0efc.$
db38a1ffc.exe$
dbcdf8c8c.$
dc5a1a10c.exe$
dcd17defc.$
dd71d844c.$
dd71d996c.dll$
dd8a7643c.$
de66b8bfc.dll$
df7c6445c.$
dfa876c9c.$
dff2db1cc.$
e107fb28c.$
e1205974c.$
e147f1d3c.dll$
e1b43f41c.$$
e2f6fcb8c.$
e396012fc.$
e413f976c.$
e4bd504ac.$
e4da71dbc.pe_$
e4f40a69c.$
e5174df3c.$
e568525fc.$
e73993cec.$
e74a3ba7c.dl1$
e8c4cda6c.$
e8e9ff59c.dll$
e914f399c.$
e9cd5511c.bin$
e9f1938bc.$
e9f37bb5c.$
ea144934c.$
ea802f9ec.$
eac1f72ac.$$
eb2478f0c.$
eb36f4b3c.$
eb8304a5c.sys$
ebd033bcc.exe$
ebf8e369c.$
ec0806d0c.$
ed2b49b1c.ren$
ed8fee27c.$
ed9a3ee1c.$
edfbdfa0c.$
ee196038c.$
ef0e2ee0c.$
f001dbcec.bin$
f001dbcec.bin$
f0bc8b9cc.$
f0bc8b9cc.bin$
f0e877dac.$
f11c2d9dc.$
f146eb1ec.$
f1addd1fc.$
f1c13efcc.$
f1c272a1c.$
f22f14b4c.sys$
f24ff7d9c.$
f294e3f6c.$
f2d73de0c.$
f2e35439c.$$$
f3381ffcc.$
f3acc193c.$
f47bdabfc.$
f4964921c.$
f49fc8e2c.$
f597c87ac.$
f5da023ec.exe$
f6467518c.$
f7983be5c.$
f79f3c06c.$
f7a9aaf1c.exe$
f7e354c3c.bin$
f8599e16c.$
f8807d63c.$
f8b74736c.$
f9f3cf8cc.$
fa198eabc.$
fa1a839ac.$
fa3faf28c.$
fabad478c.$
fadac1f1c.$
fb1c9ebfc.$
fbda32b1c.$$$
fbf7e306c.bin$
fc44efbbc.$
fc523b9fc.$
fdf35c7ec.bin$
fe24eb77c.$
ff5ed7dac.$
ffa4261bc.dll$
ffa91b32c.$
ffb4d524c.exe$
a22a476e.exe
a6ffa3b4.exe
ac91ec6be4eb19ec4e17c5af20914a22
ad79d961.dll
armdvc.sys
b46f3f8455b009860f1598de9268e9ae
ba0715e6.dll
bfde72dc.exe
c25dd9ca.dll
c7330897.dll
cd1a0826.dll
cd8aa829.exe
cda910071838f037d806bf2bfe4d10ea
csddriver.sys
d07f3a60c8287b640056e1c8359c2650
d136de6f.dll
docentd.sys
e02eeb4a.exe
e487dfbe.exe
e5661960.exe
e6949c7e3dca3171092ccce3737dcb24
e9d3bb98e5f2c81518b5da167e8556e5
ea61ce20-860c-11d3-a05d-00104b6909d0.exe
eb739c38.exe
ed80059c84b975d6b785207f5f9d7000
ercixsu.dll
f5578ba0.exe
f87d01df.exe
fa2cc2ad.dll
fc7c039e.exe
ff640b7156f875bb002f3b263d9bbd94
file1.exe
file1_2.exe
file2.exe
final.exe
gdiw2k.sys
gdiwxp.dll
gdwxp3.dll
ies4service1.sys
iesprt.sys
iesprt.sys
lsd_f3.dll
lsd_f3.dll
mdfpro.dll
mslown.dll
msplg7.dll
msstuber.dll
msstuber.dll
next1.exe
nucl.sys
rege2usb.dll
regepsrvc.sys
satau320.dll
ss.exe
svchosò.exe
sys3015.exe
troy.exe
userinit.exe
w32goldun-ab.exe
winld32.dll
xexe.exe
xexe.exe
systemroot+\system32\xkeyshll.dll
systemroot+\system32\xkeyshd.sys
xkeyshll.dll
anti.exe1
smstaqta.dll
systemroot+\system32\winsms.dll
systemroot+\system32\scsiusr4.dll
scsiusr4.dll
scsiusr4_1.dll
765f8f03.exe
scsiusr4.dll

News for Aug 28, 2008

New Version!
PestBlock version 4.1. Many new featured, bugfixes. Download new version today! Learn More...

	Download Demo Version
	Buy Now!

Buy Online

	Online Store



	Discount Pricing

Spyware Research

Browse our Spyware Research Center.

	Spyware Research

Free Newsletter

Sign up for our free product newsletter today and get informed about new updates and releases by email. You will also receive the latest discounts and offers for our products!

	Click Here to Sign Up