Overview

overview

10

Static

static

10

zugauvc1jrg0d65l.exe

windows10-2004-x64

10

zugauvc1jrg0d65l.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    zugauvc1jrg0d65l.exe
  • Size 450KB
  • Sample261027-m3tkvact8s
  • SHA256 42c768756120b01d8c07e26aba5228204be7042a8f71bfa36ba7fb494766382e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
109|gka+ij1ripd8n5iw5gkyqw==ratgomorat

Malware Config

Extracted

Family

  • gomorat

Version

  • 110|Z9GkCWj9+34cV/7v4fkt5A==

Botnet

  • 109|gKa+Ij1RiPD8N5iw5GKYQw==

C2

  • 108|eSbxfBTyeQEaDxOzcRBX1IWZOihZzHB0IiR7f2sPIEM=

Mutex

  • 111|td6G05UztNnhqTLPv2rZYA==

Attributes
  • antivirtual

    127|iOb2tfEwoOBb1Gy02NunWQ==

  • certificate

    126|nRXMwHI7uvu3l37+8ozUqA==

  • delay_unit

    133|yGmjIG0Yetjk3ks/h9E0Ow==

  • delay_value

    132|tNPjXj8dgbr3M/4h/KllFg==

  • disk_spread

    136|h3P5LE8QiWrUKRSkan1N1A==

  • enable_delay

    131|zwL3PYQyTeRj/AaFgioiAw==

  • exclusion_wd

    115|zfS5oxcNwtVFbByG8S1DfA==

  • hidden_file

    116|8a0rFgCjHmlcaOtCuLTW2w==

  • install

    112|PJf1Jb1fo8MWNqL3RCpYZg==

  • install_watchdog

    113|j83syYgU4JaXwMZeel55tg==

  • key

    129|oGxKeNgz9TMczOgtieMxKg==

  • pastebin_url

    130|mBnfnH5BjFv2Qu3xrmGmUA==

  • path_client

    124|ndZl29UqJEp6904DZt6jvEmJx/Rl9gMlcec0O6t9HyI=

  • path_watchdog

    125|g/8A6Vth2nZx1DUoMenxJQhTOqmEyMz8yNY7M62Bv9M=

  • pump

    121|wtPbLAPWz8rf3HilsBlAkw==

  • rootkit

    117|52frao/RQ3dyL1b+3PdFgw==

  • rootkit_type

    134|nZlL0ii7Ze7aDZU0j7N46A==

  • task_client

    122|3oQW9SILsbZjAwAl8BGJhQ==

  • task_watchdog

    123|WqmwZnRQ1dG6I8BiNdkT1w==

  • usb_spread

    135|WnYSNx53pl3RWD2N9XOYSQ==

  • use_install_admin

    114|Xn+tOMkDCLXs3ugyZ7wZbg==

  • user_init

    128|Dh4i+sf3BSa51z9/B+suQg==

  • winlogon_shell_enable

    120|kIqWpJ07w19MOMDs+3DUHg==

  • wmi_name

    119|nFaK8Y8EB2rslZTcGKsivw==

  • wmi_startup

    118|kxvvmhWCSdHvvJfaqN+PUQ==

Signatures

  • Family: GomoRAT

    GomoRAT is a Windows RAT written in C#.

    ratgomorat
  • Codesign digest Mismatch 1 IoCs

    File was altered after it was signed.

File Explorer

  • zugauvc1jrg0d65l.exe
    .exe 450KB

zugauvc1jrg0d65l.exe

  • IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
  • SHA256 42c768756120b01d8c07e26aba5228204be7042a8f71bfa36ba7fb494766382e
  • MD5 SHA1 SHA512 SSDEEP TLSH
windows:4windowsx86arch:x86

  • Codesign digest Mismatch

    File was altered after it was signed.

PE Signature issue

Digest
12:0f:38:cd:21:90:8c:04:33:eb:f1:7f:f6:21:d5:af:bf:a8:44:2d:79:96:4e:03:2a:a8:b5:17:9c:de:93:ab
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=14198230,CN=Crystal Future OÜ,O=Crystal Future OÜ,STREET=Pikk tn 7-5,L=Tallinn,ST=Harju,C=EE,1.2.840.113549.1.9.1=#0c1563656f406372797374616c6675747572652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024545,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

PE Signature issue

Digest
12:0f:38:cd:21:90:8c:04:33:eb:f1:7f:f6:21:d5:af:bf:a8:44:2d:79:96:4e:03:2a:a8:b5:17:9c:de:93:ab
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=14198230,CN=Crystal Future OÜ,O=Crystal Future OÜ,STREET=Pikk tn 7-5,L=Tallinn,ST=Harju,C=EE,1.2.840.113549.1.9.1=#0c1563656f406372797374616c6675747572652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024545,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Minor OS version
0
Major OS version
4
Entry point
438366
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths