Overview

overview

10

Static

static

10

19dwah3pf0um0mqx.exe

windows10-2004-x64

10

19dwah3pf0um0mqx.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    19dwah3pf0um0mqx.exe
  • Size 425KB
  • Sample261027-ne62pscv6w
  • SHA256 874d6005a31dc18c999ff58e218e9f9251e0a4a60c5a90bc641cd675a5b95224
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
109|hynyglkcbngw/myu8ergjq==ratgomorat

Malware Config

Extracted

Family

  • gomorat

Version

  • 110|9s9PGos7u7NmSBWlQLlIVQ==

Botnet

  • 109|hynyGlKcBnGw/mYU8ERgjQ==

C2

  • 108|xHJLAKou22Iur/OAOj4CCEjd0NpZveMt8aaRWKX3ngA=

Mutex

  • 111|caNoTXEMSAPHC2nUr1zi4g==

Attributes
  • antivirtual

    127|VktbDazd9Q2Qj0l/jsHM3Q==

  • certificate

    126|FQJqpko4U33V2kkqzYXlRpc3NuQuThb6oZ52eJgZnyE=

  • delay_unit

    133|3xx28R1lemw+N6KZGvazjg==

  • delay_value

    132|0DRphi0CHkvJgyHDRTdltw==

  • disk_spread

    136|PfwQOCyR2qzFtwbUQ8bqRA==

  • enable_delay

    131|A3I3u4p9xx9ZiBUwlNP0rw==

  • exclusion_wd

    115|rIr2DN+5ifgapHvNeEyrYg==

  • hidden_file

    116|m50KjvF/qO9Z8TdxKTh1Vg==

  • install

    112|Vy50tnZvzg6Fy1qMeCv2yw==

  • install_watchdog

    113|n82uPZwzoj9S1O7dMkfO1Q==

  • key

    129|wYF7r+8fS4dUkqN4vzBXXw==

  • pastebin_url

    130|vZiYQK9CC2ppB1OwJwwYhQ==

  • path_client

    124|YgKNr/hKxX31r5ex71lKwF87xmsX13XHJvPGdVHORd0=

  • path_watchdog

    125|+e5h03p6cBsDItoRN75M1LTFFFt3jqpd9DijbArl1Ik=

  • pump

    121|BREt/mWEiolbT/gijleXiA==

  • rootkit

    117|4pr9EiKSHN3Jm/I4u/pJO7Kwc1jpasg2a/M2pyKwZyA=

  • rootkit_type

    134|daAUA21N3HTNj7dJ83GA2Q==

  • task_client

    122|kGPdYV/WseNXFD4l2uPOkw==

  • task_watchdog

    123|vX0F13boZ6szyLXk0+6xMA==

  • usb_spread

    135|2zkmBhWma5ac8DgaNLAt6Q==

  • use_install_admin

    114|YF+mVRHBBFOHb57vAE16sQ==

  • user_init

    128|3u4rhazxfNk+AssPqbh+sg==

  • winlogon_shell_enable

    120|/3ozY5Z1LaTm1mhFzYMyHA==

  • wmi_name

    119|NiKVAwYd08dklEiZXJtTEw==

  • wmi_startup

    118|0M41lBLFO3dajhTKE99AaQ==

Signatures

  • Family: GomoRAT

    GomoRAT is a Windows RAT written in C#.

    ratgomorat
  • Codesign digest Mismatch 1 IoCs

    File was altered after it was signed.

File Explorer

  • 19dwah3pf0um0mqx.exe
    .exe 425KB

19dwah3pf0um0mqx.exe

  • IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
  • SHA256 874d6005a31dc18c999ff58e218e9f9251e0a4a60c5a90bc641cd675a5b95224
  • MD5 SHA1 SHA512 SSDEEP TLSH
windows:4windowsx86arch:x86

  • Codesign digest Mismatch

    File was altered after it was signed.

PE Signature issue

Digest
b0:ac:13:5e:cd:d7:01:d5:2a:81:a2:89:67:4a:56:1e:ae:c2:38:98:0e:84:d3:90:6f:70:8c:6e:ae:77:89:dc:4d:64:2b:37:fa:f5:f1:a7:81:45:fe:13:73:60:99:c0:1e:20:43:73:26:2e:ed:5b:d6:a3:2d:1c:17:e2:a5:2e
Digest Algorithm
sha512
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Hugh Bailey,O=Hugh Bailey,L=Temecula,ST=California,C=US
Minor OS version
0
Major OS version
4
Entry point
429134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths