Extracted

• • Target
    rat2026rm.exe
  • Size 1.2MB
  • SHA256 9c07f861a8b76a5d1d38456a70e227b355eb0b0e94362599a5bcbb6814de052a
  • MD5 695bf9f633e8175f8f5d9aa09ddbb0c9
  • SHA1 6d80705a8b2d8ac7ff6d3b0ac936d9568dbea284
  • SHA512 203b6ce1c737a22b92d05a9511cd449a1d1815c7e8134498442d84a203a8f368e89f1626032e68a2170a9ae5bfb9978ec7b8c470c4b16533a16254e52e346fb1
  • SSDEEP 12288:3lr8qy+8cW0Uqh2FBEiPR85hexbIqWGoTXRKGsHvZIeHQtQlD:Of+dWn9OH9B0HvZ5x
  • TLSH
    T13E55F96FFB47C908D07179BD8E977715A7EB0B527B36E746AA0027780AB86815CC3243
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaret.me/junk_codecosturadiscoveryexecutiongomoratpackerpersistenceprivilege_escalationratspyware

  • Family: GomoRAT

    GomoRAT is a Windows RAT written in C#.

    ratgomorat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1