Extracted

• • Target
    c3u50gjgbupetspf.exe
  • Size 427KB
  • SHA256 9f87724b5d8215a93f59f3b436173b09d310d2206a8321ddcf42750954fdece2
  • MD5 99e24bee8ebada48fcb1276e80c3a3eb
  • SHA1 9d6b497e727e636d2bdcd3e8add3a99d1b820a7c
  • SHA512 55704a09d6bb4134ecd7b57bde528f78953f5149e040b39e1f48154b7c8259f6aea1cab637741f413b4374def2c3939da84a8c8180569a4319377b0aa24ff1fc
  • SSDEEP 12288:9xDsUyTKaU8ketFXjkU62D/t53sn/miyr+:PDTiltdj0a9r+
  • TLSH
    T1F9943A623BC50618E9FA6E38CDCE7333EB7C93F3BA0773495A5121191D99242CE07A56
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adware109|ads/wd87d1qwb0bowy64ug==discoveryexecutiongomoratpersistenceprivilege_escalationransomwareratspyware

  • Family: GomoRAT

    GomoRAT is a Windows RAT written in C#.

    ratgomorat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2