Extracted

• • Target
    12123434.exe
  • Size 938KB
  • SHA256 25847d420e245fc401d56150cf9e5b4391259c872b74ef0d10099e8d3680d8e4
  • MD5 165455f6916b1be4a1c3129966dcfebe
  • SHA1 40d36b3d9e6fee5ef3bbd7f20efe13db0ab52bbb
  • SHA512 8143353a22f0e425b130984b9c147ce9c6771c046165fb4eb31a413b2995eb3c0753a09394e3adea853405d1c6af900dbbc4b90f5c53f18c1f6606abd3a8a383
  • SSDEEP 12288:XBxZt7etphn5ND5SuN9+NRLKBfYUYKkYIP1MZgMiztk637t/s6yPJVMM1SKUa2GU:xNetphnVSuNIROBfCKZgzkDzELt
  • TLSH
    T15815F85A7B828F49E065687DCCCD3322D7A51FF32333A30B3B086714068A5DA9D5A7D6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaret.me/junk_codecosturadefense_evasiondiscoveryexecutiongomoratpackerpersistenceprivilege_escalationransomwareratspywaretrojan

  • Family: GomoRAT

    GomoRAT is a Windows RAT written in C#.

    ratgomorat

  • Modifies WinLogon for persistence

    persistence

  • UAC bypass

    defense_evasiontrojan

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2