Extracted

• • Target
    lbcv1c4y2vw7buoa.exe
  • Size 993KB
  • SHA256 80bc64b90440ecdcc721af4b26c5f11c01aa32f89052b9775cd03f6ce1853af3
  • MD5 d75275ee83f512858579148de4a08244
  • SHA1 3a5dc1e1d64480d693c88ca439031b8fc75f9143
  • SHA512 afc579d4e20efb50a6d5f9dadec7a64fb010a1c8c7e458931ad60a40468c2e5d49388acd51a00e4c31c8541c1ad14423bdbce398c3ca3cdc85d539f5c37a24d0
  • SSDEEP 12288:8YrAblti95+PxFD4sa42+vMt/C6Pp1qMvi1P19nqZtENceaQPMPBB/djERqQVk/x:8gAZVxu/hn3KRU0KTVko
  • TLSH
    T17625E75A7B818F49E065683ECCCD7722D7A11FF32323634B3B08771406BA5CA9D1A796
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaret.me/junk_codediscoveryexecutiongomoratpersistenceprivilege_escalationransomwareratspyware

  • Family: GomoRAT

    GomoRAT is a Windows RAT written in C#.

    ratgomorat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2