Extracted

• • Target
    kmulb6unwjtvlco0.exe
  • Size 848KB
  • SHA256 15cebfc70e53a55d3ddf64830058ad2e3002b73fb3011afba1beecb50eeb6652
  • MD5 b7f3dc67128bb5955a35c18fd4091b3f
  • SHA1 e4b86e280870afd43b8c150547c8b5e8998cd533
  • SHA512 31a685f6636aafa567cf0e41394dda651d34ddf9b22151c6fedba0bca21ecec6cb33d2b4e9f201599b2fa7523e42d43a6e5d98afb49f2a171fbdbef772ddc92b
  • SSDEEP 12288:6T6ek6sE1Sf4Gz0vMuaPlmJSXxiaMCS3IAKbGTEp4h3TnT:W6ekPz1z0vh2lmJQygv4f
  • TLSH
    T15205D66A7B828F09E065693DCCCD3322D7A51FF32333634B3B086714168A5DA9D1A7D6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaret.me/junk_codediscoveryexecutiongomoratpersistenceprivilege_escalationransomwareratspyware

  • Family: GomoRAT

    GomoRAT is a Windows RAT written in C#.

    ratgomorat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2