Extracted

• • Target
    v09hlsq24iwrk0iw.exe
  • Size 368KB
  • SHA256 4792f0f0878b64a10ca1bbdc4fa8c6737caa9594dbc35f46f8f35a1da8f85b10
  • MD5 19101be42dbe5ee84110b411b52363d1
  • SHA1 6991c9ee6d5036e3e8b4f757be075f83e6d9eadd
  • SHA512 6bfbb575bd7569568a6b025997c2530dedf104b978f80b021e9133041dee46e4a8018431fa8d966750cf20dfe4983bc107223472a88d41000dcfca077d331320
  • SSDEEP 6144:oPmgecz4FTbANqmt3k0Obhxgrnc842V3qb7PSntT9h+IFw20lur/I5j9UpV:1ccBCtkjtGTcS3vtTeIFw25r/Wjq
  • TLSH
    T13D843A623FD40204E9EA6E3CCDCF7323EB79A3E3BA0B7346951121590E59342DE47A56
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adware109|0/szb2sslw4orwzlcforpg==discoveryexecutiongomoratpersistenceprivilege_escalationransomwareratspyware

  • Family: GomoRAT

    GomoRAT is a Windows RAT written in C#.

    ratgomorat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2