Extracted

• • Target
    d2gkikue5anaoxa0.exe
  • Size 847KB
  • SHA256 4a0b2cfcc08d630c8072d4a571d985543583301af7880e8eaaecdfc98a52610d
  • MD5 ef2a4c08d978f1bcbd27266005c55309
  • SHA1 4b177a628a40e2304ad6c8ee63414637ce45fd7d
  • SHA512 30f2cf46d7feb622dcd6f93c425f97f58d5dadc5679e31b064030a5dbd025e359c414ef68b4f971544fcf589cabe35d3a0476ef1afc2e992929d69e1dca92dad
  • SSDEEP 12288:R7DE8Vj/6hrR7w+FRYjfAJ6qYH4MbXMVwZ8WJmyIWXppa7DufcY/ZJFVkka5tMB9:vzFXMVl8k8zws7
  • TLSH
    T1C405E76A7B828F09E065683DCCCD3322D7A51FF32323634B3B086714178A5DA9D5A7D6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarepulsardiscoveryexecutiongomoratpersistenceprivilege_escalationransomwareratspyware

  • Family: GomoRAT

    GomoRAT is a Windows RAT written in C#.

    ratgomorat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1