gomorat | kmulb6unwjtvlco0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
kmulb6unwjtvlco0.exe
Size 848KB
Sample261027-pbghbatxbx
SHA256 15cebfc70e53a55d3ddf64830058ad2e3002b73fb3011afba1beecb50eeb6652
MD5 b7f3dc67128bb5955a35c18fd4091b3f
SHA1 e4b86e280870afd43b8c150547c8b5e8998cd533
SHA512 31a685f6636aafa567cf0e41394dda651d34ddf9b22151c6fedba0bca21ecec6cb33d2b4e9f201599b2fa7523e42d43a6e5d98afb49f2a171fbdbef772ddc92b
SSDEEP 12288:6T6ek6sE1Sf4Gz0vMuaPlmJSXxiaMCS3IAKbGTEp4h3TnT:W6ekPz1z0vh2lmJQygv4f
TLSH
T15205D66A7B828F09E065693DCCCD3322D7A51FF32333634B3B086714168A5DA9D1A7D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

t.me/junk_code rat gomorat

Malware Config

Extracted

Family

gomorat

Version

Botnet

t.me/junk_code

130.49.213.211:20780

Mutex

@junk_code

Attributes

antivirtual
false
certificate
dtb9ar
delay_unit
Hours
delay_value
420
disk_spread
true
enable_delay
false
exclusion_wd
true
hidden_file
true
install
true
install_watchdog
true
key
26nimk03vl5ntcm6jkfdzglz
path_client
%ProgramFiles%\junkSearch.exe
path_watchdog
%Windows%\junkSearcher.exe
pump
false
rootkit
e6nt7r9brnxrp3ghdf00xi3p9m77e0c
rootkit_type
junkkit
task_client
ShellHost
task_watchdog
CookieManager
usb_spread
true
use_install_admin
true
user_init
true
winlogon_shell_enable
true
wmi_name
WindowsDefender
wmi_startup
true

Signatures

Family: GomoRAT
GomoRAT is a Windows RAT written in C#.
rat gomorat

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
kmulb6unwjtvlco0.exe

File Explorer

kmulb6unwjtvlco0.exe

.exe 848KB

kmulb6unwjtvlco0.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 15cebfc70e53a55d3ddf64830058ad2e3002b73fb3011afba1beecb50eeb6652
MD5 b7f3dc67128bb5955a35c18fd4091b3f
SHA1 e4b86e280870afd43b8c150547c8b5e8998cd533
SHA512 31a685f6636aafa567cf0e41394dda651d34ddf9b22151c6fedba0bca21ecec6cb33d2b4e9f201599b2fa7523e42d43a6e5d98afb49f2a171fbdbef772ddc92b
SSDEEP 12288:6T6ek6sE1Sf4Gz0vMuaPlmJSXxiaMCS3IAKbGTEp4h3TnT:W6ekPz1z0vh2lmJQygv4f
TLSH
T15205D66A7B828F09E065693DCCCD3322D7A51FF32333634B3B086714168A5DA9D1A7D6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

8a:16:a3:4c:46:b5:8c:57:86:59:20:fb:ea:06:fd:18:89:97:fb:6a

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=GIGA-BYTE TECHNOLOGY CO.\, LTD.,O=GIGA-BYTE TECHNOLOGY CO.\, LTD.,L=New Taipei,ST=New Taipei,C=TW

Chains

Jul 4, 2022

CN=GIGA-BYTE TECHNOLOGY CO.\, LTD.,O=GIGA-BYTE TECHNOLOGY CO.\, LTD.,L=New Taipei,ST=New Taipei,C=TW

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Revocation Status

Not revoked

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GIGA-BYTE TECHNOLOGY CO.\, LTD.,O=GIGA-BYTE TECHNOLOGY CO.\, LTD.,L=New Taipei,ST=New Taipei,C=TW

Serial Number

4f:d3:df:be:31:a4:68:54:de:57:20:de

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 10, 2019 - Sep 10, 2022

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 9, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Minor OS version

Major OS version

Entry point

863358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kmulb6unwjtvlco0.exe

PE Signature issue

mscoree

dotnet