Overview

overview

10

Static

static

10

c3u50gjgbupetspf.exe

windows10-2004-x64

10

c3u50gjgbupetspf.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    c3u50gjgbupetspf.exe
  • Size 427KB
  • Sample261027-nfzzsatthv
  • SHA256 9f87724b5d8215a93f59f3b436173b09d310d2206a8321ddcf42750954fdece2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
109|ads/wd87d1qwb0bowy64ug==ratgomorat

Malware Config

Extracted

Family

  • gomorat

Version

  • 110|OfsYz5Wl4sLaVKwwnfdnlA==

Botnet

  • 109|Ads/Wd87d1qwB0BOWY64ug==

C2

  • 108|LcAtx9dWJ8/dwxp40hrTZzq4Je9+cWT5dxyDVQqwCyo=

Mutex

  • 111|whks9fzN44vKV+MsUkyaYw==

Attributes
  • antivirtual

    127|abOcrRUfgImPosJQ5AKeUg==

  • certificate

    126|+PzS/F6MEA06EWAWz8zAq9T+SO1xAiPpZNCuhfxuk/o=

  • delay_unit

    133|XqaJ/S/hRG3wsN0Ssf7Icw==

  • delay_value

    132|eDs8Xt3QeMdh9cG3NdSsBQ==

  • disk_spread

    136|YeFSjS/QfV3/ZmW9DTXh5w==

  • enable_delay

    131|b3ejhLRiaZ1CcTc/bgl4nw==

  • exclusion_wd

    115|2Ri6rNPLBWontnnRZJZysg==

  • hidden_file

    116|6as22iyczPo6xeaoZLUdEA==

  • install

    112|02EIsfsJSaOlXoycssCpsQ==

  • install_watchdog

    113|ATR4bKh9MkmYFmLqRCHDuQ==

  • key

    129|MOlLEHnhInyNq/rO33GOpRw/tFEeeTRKqcydhc1LaNM=

  • pastebin_url

    130|as/SXrr2fMi+fsJFrI2+ow==

  • path_client

    124|EJVRNDehda96Puw/MhMyW5gWuj9sm4NzKjrgthGeqiU=

  • path_watchdog

    125|XGjk9yzqvfcSpRgRxLg7h8nUerIxDOPqkcs7ZNaGGQQ=

  • pump

    121|G2AEjMhIDomK3C+u1mJY3Q==

  • rootkit

    117|544RLJgpgSfB9YQQ4Z4yDb1OXyqRr2ah55CF0wma0tM=

  • rootkit_type

    134|pKgRtFIaIfT+Rj7fT+ecUg==

  • task_client

    122|BBysZor5AXZocAzWEzRBcg==

  • task_watchdog

    123|UyuI5X86Qmr/SLezHhDvdQ==

  • usb_spread

    135|wKvwl123QWVGiojlWDIwoA==

  • use_install_admin

    114|YiMrFSsB2+kI8dScC1NiKg==

  • user_init

    128|WUoLwW8zIB+yeLKgmInSig==

  • winlogon_shell_enable

    120|6EIvXwVGGQShu6CyLeZw4g==

  • wmi_name

    119|6l6gYReJeIhfMSABWdihtg==

  • wmi_startup

    118|MESB4rvyihujfE3W9EiD2w==

Signatures

  • Family: GomoRAT

    GomoRAT is a Windows RAT written in C#.

    ratgomorat
  • Codesign digest Mismatch 1 IoCs

    File was altered after it was signed.

File Explorer

  • c3u50gjgbupetspf.exe
    .exe 427KB

c3u50gjgbupetspf.exe

  • IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
  • SHA256 9f87724b5d8215a93f59f3b436173b09d310d2206a8321ddcf42750954fdece2
  • MD5 SHA1 SHA512 SSDEEP TLSH
windows:4windowsx86arch:x86

  • Codesign digest Mismatch

    File was altered after it was signed.

PE Signature issue

Digest
f6:00:59:af:cb:db:2a:90:9d:06:6f:07:86:30:5e:a2:3b:87:a3:e1:16:ee:7f:fa:ff:8c:9a:e5:cd:31:7f:06
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC

PE Signature issue

Digest
b9:5b:9f:95:da:53:e9:ca:1f:53:f9:10:0d:50:34:b5:ee:26:c8:08
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=TLauncher Inc.,O=TLauncher Inc.,L=Victoria,C=SC
Minor OS version
0
Major OS version
4
Entry point
423630
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths