Extracted

• • Target
    clanhelper.exe
  • Size 23.0MB
  • SHA256 927048cfd3cdea496d5428e24005f7fa69c7570c5dee833fc12aa73e98b26ba7
  • MD5 333e35c4ce1288bb1d4b32c4df6a340a
  • SHA1 7167504ae98358fc24cc9efaa81db156cb6b7ef0
  • SHA512 7ee7507aad3475dc6dee5f52bee976a1a8572ed203881b1af686ac90f1d5910f620c930d60bff7a64b185e221e977e636125f97596f75a36469627ed9cc58396
  • SSDEEP 393216:51AlyjPZE34JatgKibuf7EEUmAMR8Kwzy9dHa1MxbUByXQp6orVBjD:5CM+ODKoEUmlsz+dHa1GbvQ9n3
  • TLSH
    T1843733685BC58554EBA3207CC9554111DB707BA29B02F7DF334082610A13BE9EA7FAFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaret.me/junk_codecosturadiscoveryexecutiongomoratpackerpersistenceprivilege_escalationpyinstallerransomwareratspyware

  • Family: GomoRAT

    GomoRAT is a Windows RAT written in C#.

    ratgomorat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2