Extracted

• • Target
    Vanish.exe
  • Size 35.0MB
  • SHA256 71b464a03a79fea805b1cacc4a097b90e683d7a90def87e9669c8587d99f630a
  • MD5 aa5dff1c4600337bb9ccbf484a10c982
  • SHA1 f743402d3aee07641282d0276543cbeecdc6eedb
  • SHA512 37bdd6174012237e02cf37fee28bc607ba45e0e155c0803725fad7128ca4df2bebed1ef430d8c719f7b55302439c15c00f6288b345128453869ec7e805a2ab86
  • SSDEEP 12288:khjsU40g81MHwdmbGWrOeHt8wRQWTCZoxQNGaGIRkXFaP4OfFaSGJgj2wrJDyQZ:kpNe/WIth2tv+p7SVNH
  • TLSH
    T17687E86A7B828F09E065697DCCCD3322D7A11FF32323634B3B086714178A5CA9D5A7D6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaret.me/junk_codediscoveryexecutiongomoratpersistenceprivilege_escalationransomwareratspyware

  • Family: GomoRAT

    GomoRAT is a Windows RAT written in C#.

    ratgomorat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1