gomorat | qw[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
qw.exe
Size 871KB
Sample261104-swbdksa161
SHA256 1c3e07f0e0034aebcadd72a5084c79835eb3bddbdd41931d4b16a0ca18fd78c5
MD5 292e391ee1e9cd392d24e8df346fe22c
SHA1 e4be667ed6a5a659a54e8f265a162589d743f34b
SHA512 2bdb78186c2b04c2b9d27c57e00b670ff5ec1877a2d4cc9f476edb2af22b7033e3763c9afbb1f3dd7a130ca1417e516ec249a5c1f9c4153d3c4e18734ebb70b7
SSDEEP 12288:Mk1Ejfj5xhZSBzlbZG0yYLjDavdesg6TtgFzh8xYGL/btlhBlP61jL:MfztgBXQYfwRdhe
TLSH
T12115D85A7B828F49E065683ECCCD3322D7A51FF32333634B3B086714068A5DA9D5A7D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

t.me/junk_code rat gomorat

Malware Config

Extracted

Family

gomorat

Version

Botnet

t.me/junk_code

130.49.213.211:30992

Mutex

@junk_code

Attributes

antivirtual
false
certificate
3jnhmwbtic0mbrvuh1t4e
delay_unit
Hours
delay_value
420
disk_spread
false
enable_delay
false
exclusion_wd
true
hidden_file
true
install
true
install_watchdog
true
key
sk1a2lagliq
path_client
%ProgramFiles%\junkSearch.exe
path_watchdog
%Windows%\junkSearcher.exe
pump
false
rootkit
6l6yd5h29
rootkit_type
junkkit
task_client
ShellHost
task_watchdog
CookieManager
usb_spread
true
use_install_admin
true
user_init
true
winlogon_shell_enable
true
wmi_name
WindowsDefender
wmi_startup
true

Signatures

Family: GomoRAT
GomoRAT is a Windows RAT written in C#.
rat gomorat

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
qw.exe

File Explorer

qw.exe

.exe 871KB

qw.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 1c3e07f0e0034aebcadd72a5084c79835eb3bddbdd41931d4b16a0ca18fd78c5
MD5 292e391ee1e9cd392d24e8df346fe22c
SHA1 e4be667ed6a5a659a54e8f265a162589d743f34b
SHA512 2bdb78186c2b04c2b9d27c57e00b670ff5ec1877a2d4cc9f476edb2af22b7033e3763c9afbb1f3dd7a130ca1417e516ec249a5c1f9c4153d3c4e18734ebb70b7
SSDEEP 12288:Mk1Ejfj5xhZSBzlbZG0yYLjDavdesg6TtgFzh8xYGL/btlhBlP61jL:MfztgBXQYfwRdhe
TLSH
T12115D85A7B828F49E065683ECCCD3322D7A51FF32333634B3B086714068A5DA9D5A7D6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

94:99:78:20:ed:0f:31:ce:60:5b:fe:3a:48:02:dc:fa:70:ca:a6:01:b6:b7:4c:4c:e5:a9:e8:23:58:2e:77:68

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Brave Software\, Inc.,O=Brave Software\, Inc.,L=San Francisco,ST=California,C=US

Chains

Jun 27, 2023

CN=Brave Software\, Inc.,O=Brave Software\, Inc.,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Brave Software\, Inc.,O=Brave Software\, Inc.,L=San Francisco,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=Brave Software\, Inc.,O=Brave Software\, Inc.,L=San Francisco,ST=California,C=US

Serial Number

0c:82:ab:33:56:5e:24:b4:28:ca:72:73:c3:09:d0:9e

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 3, 2022 - Aug 3, 2023

Minor OS version

Major OS version

Entry point

885646

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

qw.exe

PE Signature issue

mscoree

dotnet