gomorat | bu09o1kyzsoiehvd[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
bu09o1kyzsoiehvd.exe
Size 908KB
Sample261027-2pxgxavy8p
SHA256 aa9e6594aae8bd6f487bfcbb8007c2a0f7e5bc7262e088ff6b031f7432d9107a
MD5 f92ccd1aa2f58e9b0e3e9d98c9193efa
SHA1 5fb655aaf3fb6461fc48c095f67d44b617ec2321
SHA512 f2403c3e8141a9503338ea60f5eff5007b12be0860d1532acb1afa2cdae9baf24de75f49fa4b572173046025eea1936c37a79f6cd3483496619d4c8e28a25f43
SSDEEP 12288:MwRh9HzvvOOhAQoEJkIrkazMfe5kbLHtT8+DTjCxySsD8TsAaFUglga:ph9qOhAS+/NSG/ga
TLSH
T1C115E85A7B828F09E065687DCCCD3322D7A51FF32333A34B3B086714168A5CA9D5A7D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

t.me/junk_code rat gomorat

Malware Config

Extracted

Family

gomorat

Version

Botnet

t.me/junk_code

130.49.213.211:20780

Mutex

@junk_code

Attributes

antivirtual
false
certificate
d0aloh74q1w6raord7df7bqhay
delay_unit
Hours
delay_value
420
disk_spread
false
enable_delay
false
exclusion_wd
true
hidden_file
true
install
true
install_watchdog
true
key
kfket6kwphhvkc32s3tqlps6neg
path_client
%ProgramFiles%\junkSearch.exe
path_watchdog
%Windows%\junkSearcher.exe
pump
false
rootkit
uteygwkadzze2b0
rootkit_type
junkkit
task_client
ShellHost
task_watchdog
CookieManager
usb_spread
true
use_install_admin
true
user_init
true
winlogon_shell_enable
true
wmi_name
WindowsDefender
wmi_startup
true

Signatures

Family: GomoRAT
GomoRAT is a Windows RAT written in C#.
rat gomorat

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
bu09o1kyzsoiehvd.exe

File Explorer

bu09o1kyzsoiehvd.exe

.exe 908KB

bu09o1kyzsoiehvd.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 aa9e6594aae8bd6f487bfcbb8007c2a0f7e5bc7262e088ff6b031f7432d9107a
MD5 f92ccd1aa2f58e9b0e3e9d98c9193efa
SHA1 5fb655aaf3fb6461fc48c095f67d44b617ec2321
SHA512 f2403c3e8141a9503338ea60f5eff5007b12be0860d1532acb1afa2cdae9baf24de75f49fa4b572173046025eea1936c37a79f6cd3483496619d4c8e28a25f43
SSDEEP 12288:MwRh9HzvvOOhAQoEJkIrkazMfe5kbLHtT8+DTjCxySsD8TsAaFUglga:ph9qOhAS+/NSG/ga
TLSH
T1C115E85A7B828F09E065687DCCCD3322D7A51FF32333A34B3B086714168A5CA9D5A7D6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

4b:f4:6e:13:d8:22:3e:d9:fd:c8:f3:1e:69:06:2c:a9:6c:3d:09:74:14:ed:6b:bf:42:00:2f:f0:eb:5b:32:0e

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

Chains

Jun 19, 2023

CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

Serial Number

0c:1c:d3:ee:a4:7e:dd:a7:a0:32:57:3b:01:4d:0a:fd

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 9, 2021 - Jun 19, 2024

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Minor OS version

Major OS version

Entry point

923662

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bu09o1kyzsoiehvd.exe

PE Signature issue

mscoree

dotnet