Extracted

• • Target
    Gomo.exe
  • Size 188KB
  • SHA256 8c5be12066ac97412651e4fd9f4c214586e166db393061c986316c116d47d86f
  • MD5 3dde0847775a7569c7e391f54e20459d
  • SHA1 0a8740390a04a499421299dba2e1d92ae6606223
  • SHA512 0c58ce2c8226d6e587654303e151b8765135fc6dcab6f721fa618fc387afead15746723d5da315ac1bb4514885d2f9fced977fd7d1081be81998e4f700cfde71
  • SSDEEP 3072:G8E3UbuSd0tEud1yjIGTs+lCYALdiCpoPu4E+sRwjxlfpUxP8B8nnbe2DjSObbkI:hE3UbVud9AAJiCpoPwPAlfdB8nbPDjxZ
  • TLSH
    T1AC14F15537A98D51D63D4E7A8352B3648338C3078643E30B2ECB90DA6F2B7D9D906ED2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutiondracula_stealersheetratpersistenceprivilege_escalationspywarestealertrojanadware

  • Detects Dracula aka Samurai Stealer payload

  • Detects Sheetrat Payload

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

  • Family: Dracula, Samurai

    Dracula aka Samurai is a stealer written in C#.

    stealerdracula_stealer

  • Family: Sheetrat, NonEuclid rat

    Sheetrat aka NonEuclid RAT is a trojan written in C#.

    trojansheetrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2