gomorat | фывфыафып[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
фывфыафып.exe
Size 919KB
Sample261027-pc7e5ady4m
SHA256 0f67aff68fee969e9d2b764608e5f3081261e5a4b7d7ca065dd878b2ca41f043
MD5 80947af75d5e3ed5842d93e922eb07fb
SHA1 a897e948c04ddbd8c5c48372cd6ec9295eaabb39
SHA512 871e9c37db870769ad74563f731e628340427fa111774b46ace563fa6cb8047caa8820caccb238dce5106d397ffc309e687599c59704aa468254ed49d3a8e738
SSDEEP 12288:1McI1B9iUEm3uw1pdQ4XtDSwIeyEA1UAmNu0eSrCZdphnYkF0Ttkr7/nsjt/ydPt:7l04Wtx3A5T84
TLSH
T13115F85A7B828F49E065683DCCCD3322D7A51FF32333A30B3B086714178A5DA9D5A796
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

t.me/junk_code rat gomorat

Malware Config

Extracted

Family

gomorat

Version

Botnet

t.me/junk_code

130.49.213.211:20810

Mutex

@junk_code

Attributes

antivirtual
false
certificate
zpszu3ax2
delay_unit
Hours
delay_value
420
disk_spread
false
enable_delay
false
exclusion_wd
true
hidden_file
true
install
true
install_watchdog
true
key
p7l4afbouhjoqpxqvj71m47vvfn6h
path_client
%ProgramFiles%\junkSearch.exe
path_watchdog
%Windows%\junkSearcher.exe
pump
false
rootkit
5b5hkonjxcxh0bz
rootkit_type
junkkit
task_client
ShellHost
task_watchdog
CookieManager
usb_spread
true
use_install_admin
true
user_init
true
winlogon_shell_enable
true
wmi_name
WindowsDefender
wmi_startup
true

Signatures

Family: GomoRAT
GomoRAT is a Windows RAT written in C#.
rat gomorat

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
фывфыафып.exe

File Explorer

фывфыафып.exe

.exe 919KB

фывфыафып.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 0f67aff68fee969e9d2b764608e5f3081261e5a4b7d7ca065dd878b2ca41f043
MD5 80947af75d5e3ed5842d93e922eb07fb
SHA1 a897e948c04ddbd8c5c48372cd6ec9295eaabb39
SHA512 871e9c37db870769ad74563f731e628340427fa111774b46ace563fa6cb8047caa8820caccb238dce5106d397ffc309e687599c59704aa468254ed49d3a8e738
SSDEEP 12288:1McI1B9iUEm3uw1pdQ4XtDSwIeyEA1UAmNu0eSrCZdphnYkF0Ttkr7/nsjt/ydPt:7l04Wtx3A5T84
TLSH
T13115F85A7B828F49E065683DCCCD3322D7A51FF32333A30B3B086714178A5DA9D5A796
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

48:c6:cc:40:cb:f3:a4:5a:4e:2a:97:ad:f5:19:7e:55:dc:6a:f3:60:e2:2c:49:2b:27:4b:d6:f7:bf:33:45:fa:f6:08:4d:28:d9:c8:b2:b0:03:87:90:d7:7f:dc:2e:5a:cd:48:bc:e1:a3:88:14:98:47:76:96:ef:d4:a5:ef:c2

Digest Algorithm

sha512

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Hugh Bailey,O=Hugh Bailey,L=Temecula,ST=California,C=US

Chains

Jun 19, 2023

CN=Hugh Bailey,O=Hugh Bailey,L=Temecula,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Hugh Bailey,O=Hugh Bailey,L=Temecula,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=Hugh Bailey,O=Hugh Bailey,L=Temecula,ST=California,C=US

Serial Number

06:d4:1a:66:69:21:53:ff:be:5d:ef:e8:73:ad:ff:6a

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 1, 2021 - Aug 15, 2024

Minor OS version

Major OS version

Entry point

935774

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

фывфыафып.exe

PE Signature issue

mscoree

dotnet