Extracted

• • Target
    x0rzt3xvvkym95v2.exe
  • Size 812KB
  • SHA256 c353b1f765129c0bfcb1f9826d993093175a0b32456d34028e122175773d1d3d
  • MD5 c0550b8f1f127422ab29baf2561ea3a3
  • SHA1 6636168a6696b8b49c1ca71e6a8aaebf17c5a0bb
  • SHA512 281c47385a1e09c5dba1719eda0b5bff214518d410b686ace2203bd24e73546dd5c078001b11704f3258341d1acdc6276554889dce513d6a80776de2bc2cea18
  • SSDEEP 12288:ijIl//bHODSiJGaxUzpR+y8C+VeYz5uMPum9WHGZpjfiAKdxurnH1tqD3zR5kqot:BqbvZ13VwM1Bf4nR5uv
  • TLSH
    T1A405D56A7B828F09E065683DCCCD3322D7A51FF32323634B3B086714178A5DA9D5A7D6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaret.me/junk_codecosturadiscoveryexecutiongomoratpackerpersistenceprivilege_escalationransomwareratspyware

  • Family: GomoRAT

    GomoRAT is a Windows RAT written in C#.

    ratgomorat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2