Extracted

• • Target
    ZeninEXT.exe
  • Size 25.0MB
  • SHA256 b2fe4618f7cd49242c8ebb7cd6d837ed08edf4395e8a374a2c5000ed58c23c27
  • MD5 588457a3f73d785f37cad294481cf4bb
  • SHA1 76c1011b4d7cf0685356639da4fb4132a2eaecd0
  • SHA512 c07f3798d08a86981598133634862ea21c703e3419e0a750a523e3a7f3f2e1c37a58e40b9cd5ac63ac5a373e6eabf756eed4623d775acfbe3b6d910ea5b65277
  • SSDEEP 786432:dciKwwjspDnO1jTVL/M2zGNTByBbMbmI2tG:dczjsZnO19L/PYkM2w
  • TLSH
    T15C4723193E828E04E0E5993D8FCD3311E3A52FE653F3A73B37087A14167659B5E1A392
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  cheaterdiscoveryexecutiongomoratpersistenceprivilege_escalationrat

  • Family: GomoRAT

    GomoRAT is a Windows RAT written in C#.

    ratgomorat

  • Modifies WinLogon for persistence

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1