dracula_stealer | 5513e71dc62e2351e9f51b651d67563f71e5dc2b75fd8de57934bd095226b732

Sharing

Copy URL Twitter E-mail

General

Target
GomoRat_1.8_[H-squad].7z
Size 51.0MB
Sample260705-xpr5zae18s
SHA256 5513e71dc62e2351e9f51b651d67563f71e5dc2b75fd8de57934bd095226b732
MD5 6f1b3fb8de03e07055da6af7ed1b4b7b
SHA1 a1e439128a7e3829fb4235795bcc28bbb231cad5
SHA512 668438576660f3f3036e9af76603f207a29f88317aca2d718a562f19ee0d932eea03b1cdae3a93b6106d1c1c19f9c28cf8bd083907a37e6b1985f230f3d11e67
SSDEEP 1572864:MXELl7Ybj9aRM1JjWO2B7CDKQ5/eqWpjnRALCrS:MMl7YbB+M7jWnBm92dn+mm
TLSH
T182C733E4BF4F48D00F3C8C792F6A9B85889651A87618903D0C4075B1AD869EA79F1DFF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  GomoRat 1.8/Plugin/HVNC.dll
- Size 42KB
- SHA256 5a3f8721e6f4bba58f687cff2ec163a75c37a06803e95a51d43263b392dff9a9
- MD5 0f50e54ae3b0d6fd69decedad921e02f
- SHA1 da3cf799fbad50760b308cd7e1b379c17269ae7a
- SHA512 17c3709e285ed779209f8828f1492c4bae0c69d806d7f407e1a5275ffb4d8f43a1fe2ae05bae039b2d024fb40f69bd2a4cf4b49d15ebf039db86b403a33f181a
- SSDEEP 768:Is5LoQ6KzndQYE7CnP/LO4/g1YiZnPyxHETBTiijRLfb:I2kQ6ajE+nP/LO4qYenTpl/
- TLSH
  T167130949A7F65620EABF1A7DA473A7349334F2431903C30F2BD490A86A676D5C504FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  GomoRat 1.8/Plugin/HVNC.dll.bak
- Size 37KB
- SHA256 8ed46c276fbe05e5437080a65854d125a54c3bddeda767431e05c71ca41fbe55
- MD5 924a589ccc7a8fec3616ca6af0d33eae
- SHA1 6bfbb2ee4efeecf303412ebb1e036314764715ce
- SHA512 be23c82ff377f0a538e90f07e115c12b5f302f94884ab15f3bbc48cbbafeabbc618cab454b7502940068c108e9f7c2b888cb3b2ef10ac09e022af2ed60b5254f
- SSDEEP 768:BKB30GfVS/cvCfm+Pzn2W20EPyiH5yeEBNBjDc:BC30ZeOm+PW0EngB/c
- TLSH
  T1C40329456BF68224EBBE0676E47317648331F2830842DF0E2DC861E06A67BD89554BEF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  GomoRat 1.8/Plugin/HiddenGomoratInstallers.dll
- Size 29KB
- SHA256 40e78e678fec85e3412661d78c2ba922c0ab0424bbfd32a4055cbf711b0da8be
- MD5 6c9786db0301116ceb6c245e7c42361a
- SHA1 0cb2d66b46399699a7ea40da00355d5a86602611
- SHA512 fd879b722c142b5504a2d4fe9a8b2d9db04b80f277e7a2dec34806bd1e14577d9f57bf988923ade8bfb35092def9233f5e0680b211821dd474d25b60825f6d04
- SSDEEP 768:wMI+NdXw+cBRZb7NbWDiPOaahzpm1PwifXjdV:wybXwrVb7lWDOOdhFm1Pw8V
- TLSH
  T19BD241487BE60322E27EDB7D50F612866136BA42EC32CF4D48ED01981F57796A460F6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  GomoRat 1.8/Plugin/HiddenGomoratInstallers.dll.bak
- Size 23KB
- SHA256 7e78695790e233268345a8598db12ab2e3abb0d738f0d7419c6361684708e0c8
- MD5 2a66152f91bbf5a34835d08e68d4fa21
- SHA1 eececc6c13c3751750a40846de904a5a575d1f27
- SHA512 9bbc3188e19eb9ddcde0cf96759853fcc456e5da6f8d096eeabf9b62d35d70503476b34fcbb6a57cbd1110104e1151f46cfd00bcab6fcd5363a91956a311ef84
- SSDEEP 384:9JCOYBNhBt367zUqXh5Cm06wb8DtNpbL1rf5z8USmXNsAIv:vi2UK5b0Dba/pbL1HsVv
- TLSH
  T189B25E287BFA4B32FA6D8BBE14BB525522387502E943DF9D11A1058C393234A9470F7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  GomoRat 1.8/Plugin/HostsFile.dll
- Size 12KB
- SHA256 8c99a1ec6bc9ae1c7a1bdec992da89b7a2c0c81212fe4daa0af3b74b17414101
- MD5 85c01087a7820318a896601dedf62595
- SHA1 4b00bf471aeb60ff4fbd0e07ed857fd5e2073d5e
- SHA512 f2992831a9d5d5a1b00ce0c45fc0d6d4c1acab736e43ef3adcaa6e756076f05ad6fa9ad325955e93d2174326427e14be6ce19475dd86590db9443408b1403ac8
- SSDEEP 384:AlV/5duHWLP2rvHlM2hSYmBl++DEQBzE6qjV9a:eV/jcWiLG2lmb/GjPa
- TLSH
  T1A242D70857D44932C6FA46B7A8A397444374E2154C03CB0E7EC991F1BD57BBE6F222E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  GomoRat 1.8/Plugin/HostsFile.dll.bak
- Size 12KB
- SHA256 b85da3fddcb3624a0f6ffbc9c281e957719fa7ab2e0cb90dee2e45e2f27149a2
- MD5 2d52806f676ae7813c2d3b57ab588593
- SHA1 b8aec913e437a7076059190ca56d7539f290b832
- SHA512 05f7b25086ce7a400a7160ed73c0d85eac92f07c05de5033b0c06d8c0fefe9b24ac5cd538cc4e091eeac7f389bf711a3c70dc626362501f7ea137ded86a2214a
- SSDEEP 384:AlV/5duHWLP2rvHlM2hSYmBl++DEQBzf6qjV9a:eV/jcWiLG2lmb/7jPa
- TLSH
  T14542D80857D44932C6FA46B7A8A397444374E2154C03CB0E7EC991F1BD57BBE6F222E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  GomoRat 1.8/Plugin/HzGenerator.dll
- Size 478KB
- SHA256 3960d400efc86469e8f78afcfabccdaf573f4a8b0cf3d39526bd3b0dbe208b2a
- MD5 f6c8c86fbe356b07f5e21b7851317172
- SHA1 cc739a4fdfe67d5bfb64ba5dfea89d427cff5a8e
- SHA512 c512b628dd085bdccd471a6a0c2dc1cc7d2f14e6e5f532f8fc6174bb6047e41d64e5e1b27bfcce0717aa776708533a880be29125d8be7cdd71fe31fe2df5f31d
- SSDEEP 6144:IIcwD7D9r1HIEhAVihad2frWqEGBEZvgUjNFUprj+cbYW2sHCCFTKPr1:IrwDXHBthX2ZfFork1B
- TLSH
  T150A45A9137E4A93BD0BF23B4E4F1091747B1E0467276EB4F5680A6AD2E83B819C417B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  GomoRat 1.8/Plugin/Injector.dll
- Size 51KB
- SHA256 0a4558450fda4938974c26c237af33247ec9b85c8198d9f96bd62feaebfc226b
- MD5 a133dce9aef2ec638684d09e0be2bee8
- SHA1 f48d3b3d6c5f9b7c33217387866f10b9941ed69d
- SHA512 231bf73d1eb3016968b764dd6cd4581bdda7bc03be097d02a59bcd074fea2858e929dcf522a8383af31840bc726be37eef3d8bd08059f8e3d212ec22c5bc24d7
- SSDEEP 768:j4yBeoJGP8d57GvsEsp4bc7+2dMLaIEZyjL7PIHADRDl/BYqbeKkXsUHEJj9G:cw4nsycq2yWvYAHAdDlyytk8KKG
- TLSH
  T1F13339647398CA23CFE6477A80B71F0843B4A2558A12DF3F19C4B49A6D13B968B53F91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  GomoRat 1.8/Plugin/KeyLogger.dll
- Size 17KB
- SHA256 2b63f51d308224f01c9826eb6ee605660981b7e1b86e20a7d5e50d2fda73c38c
- MD5 534fd606f3e91f7c17b61072cb13549d
- SHA1 84a4d30acfe2521aa044591829331234ac78bf1a
- SHA512 ce8f4b1c93f68ac735955b7820e4e1d1c30b65d60f6c4715a2eff714dfab568b0c8b315c5379a08bad02e7fcd6ced6d255678fac916ff8b0625b2b216c6e0974
- SSDEEP 384:XWT5ZmoKcrBxwWjOw+BFbo///3fR/6ajV0Dam:jcHn+wf35Hjqum
- TLSH
  T1F7722904A7C44676CABE42B65933474A8B70D2029C43CB4F2DE819F6AD5BBF573112ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  GomoRat 1.8/Plugin/KeyLogger.dll.bak
- Size 17KB
- SHA256 803c3acaf283d27ed91aa8f81ee2f79933dccfd929e357f1e9f32c8cceb9f0e0
- MD5 b471ab136df4983542ed6827159b5948
- SHA1 aa73b9a96dbecc8cb0c34fc8709c100cd1ed695a
- SHA512 e242c81cb48d09bd4055639b136df819135fcd9408eb0c62fe533ee0fca8ff4d5d0799e8eb98b959140ce89f9cbad99cae51a7dd33c1bced846de14c8838211f
- SSDEEP 384:XWT5ZmoKcrBxwWjOw+BFbo///3f2/6ajV0Dam:jcHn+wf3+Hjqum
- TLSH
  T181722904A7C44676CABA42BA5933474A8B70D2029C43CB4F2DE819F6AD5BBF573112ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  GomoRat 1.8/Plugin/KeyLoggerPanel.dll
- Size 13KB
- SHA256 c8e75ba26c085957937d9df90dd258d4e1ed22df7ea5dc98270674c4f6b95a68
- MD5 2249db5e36ecef1844490dd168ae3312
- SHA1 95a028bafdb75ae116682c537961ed9ac3fc6e43
- SHA512 20c1610152040dab6e158467b85e9bf00fcdda78142bef262ca21f97c2e777cd74d4eb1efc131319b366f2a816309d7f469c333dc73874ae36c72aa5cdc6a511
- SSDEEP 384:vV56vIJfHYvky5YdpmB7+DV2P9f6qjVjk:dsv2/AxGme0P9Xjtk
- TLSH
  T17A52D70C77E09A31C6FA43FA986357484374F2159803DB1F38CD56E1AC53BAE2E516EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  GomoRat 1.8/Plugin/KeyLoggerPanel.dll.bak
- Size 13KB
- SHA256 d44d8a45e6b35445115f880c0d9ef086609f9af440e2739986beb2fe39e51c1b
- MD5 660aabc6a0100d31f82796eee9b6ccaf
- SHA1 3c7a1f66cf125a855fe650badddd344b467f11b0
- SHA512 a1de55fdc739a69a5dbb98e664f7df486347ec73e56f5c9d8a4ad0a903a2ce7aa3b1c7128019d663f727195aab433767e260d8e6b14a3c0214677701dc6cabd6
- SSDEEP 384:vV56vIJfHYvky5YdpmB7+DV2P9A6qjVjk:dsv2/AxGme0P9ujtk
- TLSH
  T14052D70C77E09A31C6FA43FA986357484374F2159803DB1E38CD56E1AC53BBE2E516EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  GomoRat 1.8/Plugin/KeyLoggerRemover.dll
- Size 6KB
- SHA256 8296a9b44d486858b9afac1bc2c64153c5f768d293217d11f93365abc23a0718
- MD5 c0e89c2c385a81a97a5b04b1a4f40254
- SHA1 1615c4c7050ac0c7f455bd3a0a8f3716f14187d3
- SHA512 472f294df8d88c5802361f7d324ad89614f4bef088be96847e8065dfb071c0c1155df4af4cc92947db04cd09117ac0c130e1f845b6379b261b539e8eba1f26b6
- SSDEEP 96:YK3+wVn3Nf+725gMy/4Fk5mxnKEHM4ZpM3DrKwh:7+S3Ng22My/4+5F6nTEig
- TLSH
  T1E9C1B812B7D85732EC628B32CCB353514674F7A8AC53CB6F28D4010BFC2665586B2FA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  GomoRat 1.8/Plugin/Map.dll
- Size 13KB
- SHA256 566dd98cfae4b3cb3d119e9e0c664e24d98f8e71de9f3f0db41a762f7084a6d7
- MD5 64b50a6b8453ed8a1ab9c8863c2d8bb4
- SHA1 a9beff272c600ce9d5e5b9a49e196e6a138bc749
- SHA512 f28ddf240261b6d00f4701477307d0b5056f913c215f094bf0b1eaab7b36470fbb93d32e761650fd5105b0fd529a835b0214d794b5711fc770c697f51743409b
- SSDEEP 192:gP34Xitapfx7eg1FYpCL5y7PclT+tFushmB1x8yPts52+b16qjVIZh:w+J7qEL5QtFuImBb8+tI1R6qjVCh
- TLSH
  T1BA52D70C67958A32C6B942B78C5267098274E3099C43DB1F3DDD52E1BD12FFD6B122E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  GomoRat 1.8/res/Sounds/1.exe
- Size 849KB
- SHA256 3fee5d97933a8e7c40e08ce156a07b99ba5ddcbcaf3c9a397d17e292028f4ebc
- MD5 ee4ad8e42048d31e16728955c9dd5fb8
- SHA1 b501311ee82dfec7d93bd83d7cd44e4a610bd8b0
- SHA512 f707abecf0ca1c5d7c3bf4e48415f480b033670810023e3f8b5ea943e05684ad39455c9507471a89d296fff7fc159bec43b025daf1149603b2374b42cb3e26c6
- SSDEEP 24576:mDWHSb4NRbob9EfCWvLLFByPzw/cZJkRPvY+1NvN:F847sOCWvLa0QKvnNl
- TLSH
  T138050201B9C188B2D6711A31593A9F10597DBC305F20DF9FA3D0995EEE302D2E635B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15
- Target
  GomoRat 1.8/res/Sounds/10.exe
- Size 1.1MB
- SHA256 ca7e07c1839954f040bc2cce5abe530614cbaee653c185e06e3522c0e418f72c
- MD5 224b6223baf9a5441a92fdd6f8acbba4
- SHA1 9b39b693a8446832e5ad65fd8c9d816b91c4b2ae
- SHA512 0cf45c2965157cdf49e7d47463b9321dac52e6573375e3cd515c2450d818134a38127c009abbf6edbd5e464930c032764850eda9f4a8990572f937b7e2ec1e4a
- SSDEEP 24576:mDWHSb4NRbobZ49m9I0gz8hZ+GVkUgeDJWAYKNX:F847enI0gzG5VWAUAn
- TLSH
  T1C4351201BAC185B2C6711F714936FB6465397D300F64DF5F93C49A6AAA302C2EB31B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16
- Target
  GomoRat 1.8/res/Sounds/11.exe
- Size 755KB
- SHA256 01507950d9f1a2e3233cf692cf0673e45199ffacef39924036ff971541459baf
- MD5 db3a28b68a4e71fefa4554d03da48eb6
- SHA1 06cc6702b9a339588695ef77867db5bd7f0cb318
- SHA512 4491d5f736db0bd0f486683b886ea32163d8134f061c376f5c4415949fed284552a0f4b5b887ce57e88be615b990c66a00aed0f8b14dabb3bca1bc6566f14d5f
- SSDEEP 12288:wzxzTDWikLSb4NS78Pzo8O7XSs8pV+Fp6GEVEPrGILAYMDQZcBrV6Lz:mDWHSb4NRbobuH+FcHjY2QkZaz
- TLSH
  T17BF4F241B9C188B2D6711F358836AF6059397C300F749AAFA3D4D62D9D302D2EB35B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17
- Target
  GomoRat 1.8/res/Sounds/12.exe
- Size 4.0MB
- SHA256 c4197dd99f34c237a110b362117fb2a9a11bf2ebc165e459a60b1a8048c2f0fe
- MD5 fd8f4d2b806c1920fa377ea3d3807bd5
- SHA1 5bcc8569c6bd471e94fe1ab96b094b264b8bb95b
- SHA512 80dc8be0ca48bf65063dae3f6985d4a5ca8f0f8262082ae0ca3264eae5778ac26569f3e68aa07d359d0e420e221ae1d1ffffb2708181402910926accc937354d
- SSDEEP 98304:FFU8bgc9OS+r4yu+Wv/2e53CoyLvNEkRQzp2f7Nye7pD:nUYgcr+r4lvuwCFLvNEGQtcFpD
- TLSH
  T194163301BEC59470C6A25B72883DEE206A3DBD306F516F5FA3D09E2E99305C1DA357B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral18
- Target
  GomoRat 1.8/res/Sounds/13.exe
- Size 841KB
- SHA256 bc86e247f2114add4ab5486e80390d039c78c5ceacce001abf126bd7c329a653
- MD5 9a14574cb759d7ef6f0e2be805ce8125
- SHA1 6090e65f4db2e48a8012efd40285595f86f3b102
- SHA512 afa3e6c0b12a557a8c2c2e5a773608ca5233774a0729c3842db2be3b1727194e63ab5e050957fef5aeb60b35aabf5558cb60e774bcabb817313f0d0de0749e29
- SSDEEP 24576:mDWHSb4NRbobJaP3TgvZ+WuK+qQm1jqi3jKzmnkdk+p:F847JP3TgvEWuhqpqi3Ozmn0p
- TLSH
  T1F8050201BAC148B2D6712A71953BEB50693D7C300F609B9F93D4995EAD312C1E731BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19
- Target
  GomoRat 1.8/res/Sounds/14.exe
- Size 453KB
- SHA256 8a2791bae8654ced34518f322a08336e02b772f61cb4eaaf6081d9892bd7af27
- MD5 998ce18841bce68f55f86cfdc5019325
- SHA1 1290a5bf341aaf469ee47c6d47a4ef0aa915ea1d
- SHA512 6d93291471fe854bd8058c106a7b5bbea7ac4fb862a5ac7bdc1a2475290aa5d2744ec45595c2fb7774780a0f29294e477f3724dee6a53084f963c6a9b23d1c15
- SSDEEP 6144:L8JsLcpjzTDDmHayakLkrb4NSarQWxPFxowtO7XGMBpT4enzuYlkDrL9dMhSD239:wzxzTDWikLSb4NS78Pzo8O7XVBF5hSCt
- TLSH
  T16FA4D101B9C198B2D6711E31553AAF2069797D301F24DF9FA3D4992DAD302C1EB32B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20
- Target
  GomoRat 1.8/res/Sounds/15.exe
- Size 86KB
- SHA256 7189f55b3d5153bd190991dc5e3349755e300fd20b0e52a34e57579e20308888
- MD5 dd15af9b32ea193e0c82887e4601f2a7
- SHA1 bab37b838bc1d858906f1ddc66c5d1168320d192
- SHA512 f51542a4f6ae0d92cfe18afe4ff64c4961e04e24f2fa88da1adcaeebae28928c63e3d33e975fd413608fd3d03c5111340dbd8c4ff6a721e72154f5b7c5a54688
- SSDEEP 1536:E7f9h0UPJP/CpICdikMLMLv5PFNg1qrX+VIOlnToIfXgIxcfOf:6liUPXC8k1nJrX+fNTBfzeE
- TLSH
  T1A7836C41F3E642F7E6F2093201F6716FA639A6289714EDD7D34D3C029A52AD09A343F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral21
- Target
  GomoRat 1.8/res/Sounds/2.exe
- Size 475KB
- SHA256 2655bf62419df0c14ede6edfddc117e63c37db54f47468aa815ba9734ae9736a
- MD5 e04679e4867a5339c88e60f07628228b
- SHA1 15f8a6c5cf23ddfd1f3e727b6e4f5c86428e817b
- SHA512 50c5973c6bf1c25ffd3c4cac23d785eb1754bcee25476db64680bc3e8aa4f5882aa17c95ccfd506f115dd242a8b05251040f79bbf24ff7111350bc4066a62957
- SSDEEP 12288:mtH5NLaAdDhAAEIFWT+tkng6hAU1uljDkH:mtH5sAdXEIFsnzSUcdkH
- TLSH
  T146A4E103B9C185B2D42318334A255F21B67DBC301F268EDB93986D5DEE361D0A736BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral22
- Target
  GomoRat 1.8/res/Sounds/3.exe
- Size 469KB
- SHA256 dfc5247b2b793d1d131eda7f5cced15c9fe53d8871f16ad2a469ad8c28d10974
- MD5 0372141286de9ba287eaab6ddc73978b
- SHA1 411985956bd6caefa3bd615d3a4d237d400d82ef
- SHA512 1ae4079093d472b3c300c4d8151be84caa7f547643d0effb0bd9a23f4532c60d50e09eb3b271de07d2c73cc06158196109a916ac8949b4532be80c50dcb87daf
- SSDEEP 12288:mtH5NLaAdDhAAEIFWT+tknY87GjpZjl/U:mtH5sAdXEIFsnz785l/U
- TLSH
  T1E7A4E102B9C585B2D43214330A29AF50B67CBD301F368DDBA3946D5DEE361E0A7367A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23
- Target
  GomoRat 1.8/res/Sounds/4.exe
- Size 332KB
- SHA256 ea7379f8ecc1cff0901dc2aa0b405fb8605cf803c058af670e5bcb5459245a50
- MD5 ecadd0bc61f7c5494e5aaa71eb282722
- SHA1 3a6c327caaa0b57f10832a27c038ec51e3ba1891
- SHA512 ed02520ce640f2a209a5d46abd95cbface4cabc7c6126ee7e1f8eec935551fdb9ee18b917f3f6c878120f5ec4c3373088d79123e4e23074db8b54f15424a8a39
- SSDEEP 6144:mtH/xNLaAOvIBd7lAAxWS1elIoSNwT+tkmqu:mtH5NLaAdDhAAEIFWT+tknu
- TLSH
  T11B74C003B9C185B2D42214331B259F61B67CBD301F668EDB93946D5EEE321D0A732BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral24
- Target
  GomoRat 1.8/res/Sounds/5.exe
- Size 347KB
- SHA256 a1707d323884993e59935d9ea14330f3fc4984fe47de07f97db1026749699ef6
- MD5 b0782e67024af605c4d6f25fe9561783
- SHA1 c0d77b2be59c81c02624b32d1ceedd15b6d970b3
- SHA512 3a959b409cfd7462e36989f329b41c65429c309fd8fde031c9b6cbd84aacb40d42613eac2bd966f103ab92943d29cda7523ef1310f5d2fadba55d07a7a7ca7c2
- SSDEEP 6144:mtH/xNLaAOvIBd7lAAxWS1elIoSNwT+tkmqlb:mtH5NLaAdDhAAEIFWT+tknV
- TLSH
  T14A74C003BAC085B2D42214331A259F61B67CBD301F768EDBA3946D5DEE361D0A7327A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25
- Target
  GomoRat 1.8/res/Sounds/6.exe
- Size 505KB
- SHA256 0182835e9fe09294d1a2afe8b7814afc8983ce4dea07fe4f6e96a8603c1c74f7
- MD5 15e077a5816c2a5be3ead115da22b55a
- SHA1 2cc8131967e661f64cc4f18fc1d4bf3f965da8ee
- SHA512 734b8949b20cd7427a0aba86e45425e4604309ccfa7160c5cf7653529eb3feb635f2e48288c09a71920bc6294538104a352bfd7947f11f1e445705009cd3463b
- SSDEEP 12288:mtH5NLaAdDhAAEIFWT+tknCYhOOXAnuaad21h5+y:mtH5sAdXEIFsnTgOPJg1iy
- TLSH
  T156B4F103B9C189B2D56214331B25AF21B57D7C301F628DDBE3946E6DEE321D0A7327A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral26
- Target
  GomoRat 1.8/res/Sounds/7.exe
- Size 285KB
- SHA256 61fc5dd1e9e68899f94d104f97ec645915155281f46fb8b196197752c269e4a4
- MD5 a3b7f598164d20a997b359898c4e3117
- SHA1 4f4880961c4228af91ab1e84e14df3a778ad2fa4
- SHA512 e0401fb98133f0ed04586f2b158fe17eeb8684fe2b95021fdcf255158743e08db6c0a12fa684d3733342318d960f42fea25b99555d59ff6c8012b22f20dbc6d1
- SSDEEP 6144:LjyGJCMfnZtZ6yrsAqRuIGa1TGOh8gj0DSA90GIlACUGgTl1mfcsoS:LmcnZt8yJqRuIT1C/40DPCLACUGgB1mJ
- TLSH
  T1AF5423604ABDF528D11F86777EFBA62424231C4C7F00F253B8D5203A89DE9991E4EEE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery upx
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral27
- Target
  GomoRat 1.8/res/Sounds/8.exe
- Size 1.1MB
- SHA256 30753793ce4b36830eb0d39ab6c252c2d1054f0a29270f9719696353bde316c7
- MD5 49edb4ec07b391ea6870fe2ee46f3a12
- SHA1 949fc2320265bfa9fbc8c14f407b65f9c021fc60
- SHA512 6f975eae7906d55fd8f3ea1abcd8d455058d76c1add9a31b8df3377725aafd0d4bb7726fd2c31a024894d362ed132e98a4e30f569d37c2bb3ed1ff79d7d429c4
- SSDEEP 24576:ooDl0/A+jmp8m58KkVeeV6DtVUz/wdcEEpROPeFTZkYOIKXu:CAFOeeMUzCkwcZkYOZ+
- TLSH
  T1484533024F48A978F8E793F46E2E88EDE70D17C56BC6C5E6ECC157B67E982022303559
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery upx
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral28
- Target
  GomoRat 1.8/res/Sounds/9.exe
- Size 491KB
- SHA256 339d6f6a966cd224eb8fcda05047b03d763c0b6526c9a7f54338dedb3f76ab9f
- MD5 78415235bfeb9b4e0217dc2cf5896a8c
- SHA1 2bf77b41eb7fd84287c3ad679432a81bbd9e8105
- SHA512 e7b3f9913516f81615eed9db68078cfcc76f59eb0a2429e18f70aa2885fa39c7120a90689d970277a6d969bb6dfe094cd2f1a3b92ff1e080d02a61e0207f8f09
- SSDEEP 12288:wzxzTDWikLSb4NS78Pzo8O7XV+MJi1K3al4bpWFYYX:mDWHSb4NRbobh+MJiGalcpWF1X
- TLSH
  T1D3B4E101B9C148B2D2711A31543AAF2069797D301F34DFAFA3D49A5DAD312C1EB35B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29
- Target
  GomoRat 1.8/tools/FileConverter.exe
- Size 9.8MB
- SHA256 c0b2166f99917d50ae27a0218966a8a10e0e2e2cd25254936f07b0de797e8bdc
- MD5 ad78f66e453c32b7ae5e5af504e4ce19
- SHA1 892a2ea004f92d5a351bc34a387acf2fa35aacf5
- SHA512 69558a5c0fa0b8843fed805733b4e25cff3b9b7eb969d8889d19ab371f61d2e2fbd0434e19ec01e7ebbf119012534ac9cf8da4e90e716a915bc74cb110a5e8f0
- SSDEEP 196608:Gv8SL0W8/LaRne4gdQmRm8Qnf2ODjMnGydSIaC2ccQwvPW4MO:OlAW8JdQdF3MnG3IaC2RQwvPW4x
- TLSH
  T192A63385BB8D08D4E85B663DC4C25E0683E2BCA207B8C6A39BF41D550E9B1D8FF36754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral30
- Target
  GomoRat 1.8/tools/SteamTokenLoginer.exe
- Size 8.6MB
- SHA256 66c9f06c2a8a07369a5e6755bee9e0e36cc3b54bfa7d2d6a2e11d070ea2c9323
- MD5 490f9eb0cbc154e788f5e996ae82deb2
- SHA1 9a5a2522917ab2d75733fdfbeb8140b78d856457
- SHA512 67e7ff1c5a3b9d91795454bcc56d3c93a24ee0a5096cbecf90a10a8dc95c10584b33add632bcc0891f64fb7b1b2cb65cd2e0b2f3dcfbdbc899c256eb872f7f54
- SSDEEP 196608:xV4CokID0pUzPLhQNQm8NkKemdQmRrdA6lhCy1ArqkVpKCX+PrF4ZUeghqHsMih+:0SpUTLfhJjdQOlhrAZYCuPJOUegYMZ+
- TLSH
  T18896338823801CF5EE95913DD8698A2EE6C1FC626360D77B03E49B9B2F172D06D37B54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral31
- Target
  GomoRat 1.8/tools/tokenToCookies.exe
- Size 7.7MB
- SHA256 ef234a1ea1c24ee7bf7ef46e04e2e8ef70461abfa2a5be844467ebb51e55fa20
- MD5 2dead6e109e443b72682e364827d1eec
- SHA1 7b3b7f4bf120c0b78119745e898c38c53bdc0b46
- SHA512 21f3aff351d6c18f6e113d510311ec3adbfd956671f6583d88208c940f0908b20362b8c7a9029143db9941446f3d437b187d80f1ee64fe89f60270ef7c16f4b8
- SSDEEP 196608:j6F2eODfyGgMwBdnpkYRMWfM8u1leRE/w:xDfDgMc6WfXeeR3
- TLSH
  T17F863322E1900DD9EAF79239D941E329F6B3B4524746DAC757B88B623F237E0083E751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Loads dropped DLL
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

UPX packed file

Enumerates connected drives

UPX packed file

Enumerates connected drives

Loads dropped DLL

Loads dropped DLL

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32