Extracted

• • Target
    qw.exe
  • Size 847KB
  • SHA256 705210d1658944aa34d3906954e96fc91643883af9007f82b9f825a653c88345
  • MD5 c8d19a9890a64bb25285c74d22721555
  • SHA1 4ad7f9994359e47fe4cbbbe0497334951572589c
  • SHA512 99ab9668d8cacf6acbd953b0fa88d0191f9d6fde80756ef9119573839361639a497b2c94dde33b1452ba2ae5af1afa5203616d4bb38a361f4583ace71679e728
  • SSDEEP 12288:HbSVuGtUFa0J1LLV+l8SsIVr14h4uQjOcEK2+I:7IdKDqn2+I
  • TLSH
    T16E05E76A7B828F49E025683DCCCD3322D7A51FF32333634B7B086714168A5CA9D5A7D6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaret.me/junk_codecosturadefense_evasiondiscoveryexecutiongomoratpackerpersistenceprivilege_escalationransomwareratspyware

  • Family: GomoRAT

    GomoRAT is a Windows RAT written in C#.

    ratgomorat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2