Extracted

• • Target
    x0rzt3xvvkym95v22.exe
  • Size 522KB
  • SHA256 d442c074f34ed1b6f2a15696caa0ba53c7bb156b7f2040a4c02040c0b94c6602
  • MD5 edc87967a726908b3a74f3aef3284a1d
  • SHA1 4fbb85f8c6e807cf686f0a5d31286f3f1986e708
  • SHA512 9ad8968090621b17ae009766b2ae08d12f4089d599879d2cebe2bba50de8fb2935db2f92670ef8e116dec981a028ef89e7ed4e2a2baf04c4dc98557522e51eac
  • SSDEEP 12288:vPgo9OFBBWAGaxU/lq76j/HA45kqoTRv:NoqDjvx5u
  • TLSH
    T17CB470181FD58910FB96287CD5450151DB746BB2EE02F3DB3600C2654912BEEEA2FAFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaret.me/junk_codecosturadiscoveryexecutiongomoratpackerpersistenceprivilege_escalationransomwareratspyware

  • Family: GomoRAT

    GomoRAT is a Windows RAT written in C#.

    ratgomorat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2