Overview

overview

10

Static

static

10

v09hlsq24iwrk0iw.exe

windows10-2004-x64

10

v09hlsq24iwrk0iw.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    v09hlsq24iwrk0iw.exe
  • Size 368KB
  • Sample261027-mdarfazy9r
  • SHA256 4792f0f0878b64a10ca1bbdc4fa8c6737caa9594dbc35f46f8f35a1da8f85b10
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
109|0/szb2sslw4orwzlcforpg==ratgomorat

Malware Config

Extracted

Family

  • gomorat

Version

  • 110|EOSaFCbyO6cKdfmj7u4nwA==

Botnet

  • 109|0/szb2sSLw4oRwZLcfoRpg==

Mutex

  • 111|FfA2fLd1Yjf+adZFu7OFKg==

Attributes
  • antivirtual

    127|QD4lQRlw49SvREpnNqmlnA==

  • certificate

    126|ZCqiUmHgz0ussB89ZYB0xw==

  • delay_unit

    133|Th7sdUsvIss0NDt++vtvgw==

  • delay_value

    132|KvoxTOA1mZLrT60i1Oxn9g==

  • disk_spread

    136|Fn3O+YTEMONfc2y1sYk2OA==

  • enable_delay

    131|u5a5iCADeEw4+qJ8Shtt8Q==

  • exclusion_wd

    115|v3aFjH0iihT+Go3nsKemgQ==

  • hidden_file

    116|s7B8B6uKM2rC2zZvMAdduw==

  • install

    112|gpBSw9XbqRtcLkGjvTVnuw==

  • install_watchdog

    113|vot5HTm3hwn39G19K8vtcw==

  • key

    129|FEeD4+j3EEmXieSXEafuWCWqpWhdVDvtOsXnU4zhSKw=

  • pastebin_url

    130|UB+K1mxBB7QMvGKMoBIBqQ==

  • path_client

    124|hKJGtr0O5KDxdzv/8OFqg/mLh6ZF7+4e2E34yULBISU=

  • path_watchdog

    125|zeGFaxBymPRfumYyx6qRkiek39x7Smg2ydSAdZjPUt4=

  • pump

    121|gnfeYOhA0d+DCSFzsacQ4A==

  • rootkit

    117|qALJ/XeBayXYYD8G61i4ky3hSGi3V7hXM5t2hbuUB1Q=

  • rootkit_type

    134|x3gl2P8VPodFARzWt34wXw==

  • task_client

    122|w9zY9Ix+RKHeU8LUtz6yCQ==

  • task_watchdog

    123|GPLXk3Icj9YvPw18tZcndg==

  • usb_spread

    135|oSX2b+2GgWCgK1/X0KgEDg==

  • use_install_admin

    114|bxaiV29TXI/xRB+qC9euBQ==

  • user_init

    128|djhbqegfTsVGj3iT3La1YA==

  • winlogon_shell_enable

    120|h1jL3/j1itY9fY1FUeq30w==

  • wmi_name

    119|e5TrNp6iU/UvyWgj0ndr4w==

  • wmi_startup

    118|guySF3+L6B9XWDv/Cvy/SA==

Signatures

  • Family: GomoRAT

    GomoRAT is a Windows RAT written in C#.

    ratgomorat
  • Codesign digest Mismatch 1 IoCs

    File was altered after it was signed.

File Explorer

  • v09hlsq24iwrk0iw.exe
    .exe 368KB

v09hlsq24iwrk0iw.exe

  • IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
  • SHA256 4792f0f0878b64a10ca1bbdc4fa8c6737caa9594dbc35f46f8f35a1da8f85b10
  • MD5 SHA1 SHA512 SSDEEP TLSH
windows:4windowsx86arch:x86

  • Codesign digest Mismatch

    File was altered after it was signed.

PE Signature issue

Digest
e5:bb:1e:79:fa:18:60:ca:5a:eb:c1:f4:47:26:b2:c1:43:07:03:88:21:ae:3f:28:c6:5a:7d:f5:2d:7f:de:a3
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=14198230,CN=Crystal Future OÜ,O=Crystal Future OÜ,STREET=Pikk tn 7-5,L=Tallinn,ST=Harju,C=EE,1.2.840.113549.1.9.1=#0c1563656f406372797374616c6675747572652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024545,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

PE Signature issue

Digest
e5:bb:1e:79:fa:18:60:ca:5a:eb:c1:f4:47:26:b2:c1:43:07:03:88:21:ae:3f:28:c6:5a:7d:f5:2d:7f:de:a3
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=14198230,CN=Crystal Future OÜ,O=Crystal Future OÜ,STREET=Pikk tn 7-5,L=Tallinn,ST=Harju,C=EE,1.2.840.113549.1.9.1=#0c1563656f406372797374616c6675747572652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024545,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Minor OS version
0
Major OS version
4
Entry point
354382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths