Extracted

• • Target
    oax1fzmej3vuqjux.exe
  • Size 386KB
  • SHA256 f0ebc2250322fff2d26931279b2d9df6ec49fe19e997ad1385ff1509347a6e97
  • MD5 5167ac4c08c8ee6743d70a8ad494d5fe
  • SHA1 3bb882e9724f3fab4c03e410f9400b242bb8af36
  • SHA512 635cc8f67170b40eb43eccdcb9b1d7ed61ef7cea45711712868976dace21d00af50c9fdf8ae883ff9d65541b038a22e09ded0ad0bf04ccbedd01f99898811dda
  • SSDEEP 6144:CGAEsgvrOQL+0+glR5ZogcJOPm5f1bYpSagOL0DC1e9E9:VvSMLD5OgQGmlipvgOLSy
  • TLSH
    T1E9843A623FC00608E9FA6E3C8DCE7333DB7993F3BA0773069A5121190E59646DE47A56
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adware109|roy+ehgcf6jkdduohxemwa==discoveryexecutiongomoratpersistenceprivilege_escalationransomwareratspyware

  • Family: GomoRAT

    GomoRAT is a Windows RAT written in C#.

    ratgomorat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2