gomorat | 5zft4fleim4t7qin[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
5zft4fleim4t7qin.exe
Size 862KB
Sample261027-2hjmgag17r
SHA256 63a07ab8e97d82fa41944b6faea24293b91ecdf71cfa6c71dd5ebf085ee2da97
MD5 d0c69e492d1de8f1e048468714c410b1
SHA1 d225698905fb27a5c52d380f28e8c4c63767a05a
SHA512 c425bfca76be448fa490e1fca7bf7081ab16a30bc7bde180f02aa16a4722f0f149febafc006908c1686a604768002a3f401a7b3c4b5eab9d8019e1e9531381e2
SSDEEP 12288:N3VkGyxghA00D7Q1Wvn8hJmI6JcL+VuH2oZYAmaIScbEAOThT:NqGn0D7QsplPMFJ
TLSH
T1DA15F86A7B828F09E065683DCCCD3722D7A51FF32723634B3B086714078A5DA9D1A7D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

t.me/junk_code rat gomorat

Malware Config

Extracted

Family

gomorat

Version

Botnet

t.me/junk_code

130.49.213.211:20780

Mutex

@junk_code

Attributes

antivirtual
false
certificate
ke3uzx64hkzlpc72qgr
delay_unit
Hours
delay_value
420
disk_spread
false
enable_delay
false
exclusion_wd
true
hidden_file
true
install
true
install_watchdog
true
key
6nvhg1xd256oqs60w2tborpp0wbqu
path_client
%ProgramFiles%\junkSearch.exe
path_watchdog
%Windows%\junkSearcher.exe
pump
false
rootkit
uywp9ro14djf2t4c1hvznzz
rootkit_type
junkkit
task_client
ShellHost
task_watchdog
CookieManager
usb_spread
true
use_install_admin
true
user_init
true
winlogon_shell_enable
true
wmi_name
WindowsDefender
wmi_startup
true

Signatures

Family: GomoRAT
GomoRAT is a Windows RAT written in C#.
rat gomorat

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
5zft4fleim4t7qin.exe

File Explorer

5zft4fleim4t7qin.exe

.exe 862KB

5zft4fleim4t7qin.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 63a07ab8e97d82fa41944b6faea24293b91ecdf71cfa6c71dd5ebf085ee2da97
MD5 d0c69e492d1de8f1e048468714c410b1
SHA1 d225698905fb27a5c52d380f28e8c4c63767a05a
SHA512 c425bfca76be448fa490e1fca7bf7081ab16a30bc7bde180f02aa16a4722f0f149febafc006908c1686a604768002a3f401a7b3c4b5eab9d8019e1e9531381e2
SSDEEP 12288:N3VkGyxghA00D7Q1Wvn8hJmI6JcL+VuH2oZYAmaIScbEAOThT:NqGn0D7QsplPMFJ
TLSH
T1DA15F86A7B828F09E065683DCCCD3722D7A51FF32723634B3B086714078A5DA9D1A7D6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

70:12:d9:34:11:9d:ee:dc:c2:50:da:9f:21:5f:03:29:72:17:11:ab:42:76:97:2b:05:4b:cf:2d:32:89:36:fa

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=C 86211,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Prague,C=CZ,1.3.6.1.4.1.311.60.2.1.3=#1302435a,1.3.6.1.4.1.311.60.2.1.2=#1306507261677565,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

May 16, 2023

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

62:f8:12:a3:5f:52:bd:74:b7:18:d6:10:ac:4b:47:83

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 11, 2018 - Sep 11, 2023

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 26, 2019 - Mar 22, 2034

Subject

Serial Number

78:55:9d:9a:1e:2f:c1:a4:79:d6:27:68:4d:11:3a:59

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 19, 2021 - Aug 18, 2024

Subject

CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2022 - Dec 6, 2032

Subject

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 11, 2018 - Sep 11, 2023

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

Major OS version

Entry point

875710

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

5zft4fleim4t7qin.exe

PE Signature issue

mscoree

dotnet