gomorat | bstgkamldssfmjkq[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
bstgkamldssfmjkq.exe
Size 918KB
Sample261027-2lcckavy6q
SHA256 82864dc14e19ab5d57d464d54efa3386ea89a1b7ac5a313291318e368eb2b9c3
MD5 de71fdf6656d64adde05dbcf545502a5
SHA1 9bf05376cf66c3ea9568cc43a8630e8b56f869b8
SHA512 754a15b4e2d0db7890f7bea2f936d1c688873e58b5ddbbf40188e95e5986a02c0f2af63213eb9f28756c2f34e47932658e0e8aff7413bed8178685695c6c0b09
SSDEEP 12288:sIEu01Vpw38E/mxRhkhEoCl/QfS6A+MdGUhryZasPZNnm/3n5R0qFGb4goNMMr54:stnBE+xoSZQ66AnrKyTvXmyR6
TLSH
T1F415E86A7B828F49E075683DCCCD3322D7A51FF72323634B3B086714078A5CA9D5A796
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

t.me/junk_code rat gomorat

Malware Config

Extracted

Family

gomorat

Version

Botnet

t.me/junk_code

130.49.213.211:20780

Mutex

@junk_code

Attributes

antivirtual
false
certificate
w026dacc935fdjss3sfnmqbgq
delay_unit
Hours
delay_value
420
disk_spread
false
enable_delay
false
exclusion_wd
true
hidden_file
true
install
true
install_watchdog
true
key
vfs19o0wy9eozmod5fatyg9
path_client
%ProgramFiles%\junkSearch.exe
path_watchdog
%Windows%\junkSearcher.exe
pump
false
rootkit
7czcys74h
rootkit_type
junkkit
task_client
ShellHost
task_watchdog
CookieManager
usb_spread
true
use_install_admin
true
user_init
true
winlogon_shell_enable
true
wmi_name
WindowsDefender
wmi_startup
true

Signatures

Family: GomoRAT
GomoRAT is a Windows RAT written in C#.
rat gomorat

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
bstgkamldssfmjkq.exe

File Explorer

bstgkamldssfmjkq.exe

.exe 918KB

bstgkamldssfmjkq.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 82864dc14e19ab5d57d464d54efa3386ea89a1b7ac5a313291318e368eb2b9c3
MD5 de71fdf6656d64adde05dbcf545502a5
SHA1 9bf05376cf66c3ea9568cc43a8630e8b56f869b8
SHA512 754a15b4e2d0db7890f7bea2f936d1c688873e58b5ddbbf40188e95e5986a02c0f2af63213eb9f28756c2f34e47932658e0e8aff7413bed8178685695c6c0b09
SSDEEP 12288:sIEu01Vpw38E/mxRhkhEoCl/QfS6A+MdGUhryZasPZNnm/3n5R0qFGb4goNMMr54:stnBE+xoSZQ66AnrKyTvXmyR6
TLSH
T1F415E86A7B828F49E075683DCCCD3322D7A51FF72323634B3B086714078A5CA9D5A796
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

97:01:1c:7a:3d:83:1c:4b:ec:86:4d:29:76:72:5b:d0:ff:31:f6:8e:9b:15:c9:23:12:62:92:7d:0e:07:9d:c2

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=C 86211,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Prague,C=CZ,1.3.6.1.4.1.311.60.2.1.3=#1302435a,1.3.6.1.4.1.311.60.2.1.2=#1306507261677565,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 28, 2023

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

62:f8:12:a3:5f:52:bd:74:b7:18:d6:10:ac:4b:47:83

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 11, 2018 - Sep 11, 2023

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 26, 2019 - Mar 22, 2034

Subject

Serial Number

78:55:9d:9a:1e:2f:c1:a4:79:d6:27:68:4d:11:3a:59

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 19, 2021 - Aug 18, 2024

Subject

CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2022 - Dec 6, 2032

Subject

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 11, 2018 - Sep 11, 2023

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

Major OS version

Entry point

933118

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bstgkamldssfmjkq.exe

PE Signature issue

mscoree

dotnet