gomorat | DataBase[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
DataBase.exe
Size 916KB
Sample261106-dat68shy7l
SHA256 ce8d311bc103c8115b7ba8e6d58f4a3827fc53b7be41048beaa4bba67a8531d2
MD5 ea27e69bb910466d13dbb0106a83f76b
SHA1 9d46e4494e39db42dbdf66e89b6e13d8c96f2887
SHA512 c3229ee29c1fd78ea7324d7d9d306895cbe24ded1dddf6067db32d032a68261dc1b91ee6008b3391ba46f1d85d820cd81e9d2e46453f5e6bebb663673a958838
SSDEEP 12288:3Z3xS1ClK3qbw3ByKfRP0lN/JXIiSIOTgzUHKtZZNbmPbZ2xAQtRSBhU:3fSWnwzPJiNlAtol
TLSH
T18D15F86A7B828F49E065687DCCCD3322D7A11FF72323634B3B086714178A1DA9D1B796
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

voxeltools rat gomorat

Malware Config

Extracted

Family

gomorat

Version

Botnet

VoxelTools

2.26.81.75:51948

Mutex

))u)!0*b)3)hb2$izp3@tfvq(+f

Attributes

antivirtual
true
certificate
0m6dd1vduz
delay_unit
Seconds
delay_value
1
disk_spread
false
enable_delay
true
exclusion_wd
true
hidden_file
true
install
true
install_watchdog
true
key
gaasoh7yxn6r25weevuqjrgyk43
path_client
%ProgramFiles%\junkSearch.exe
path_watchdog
%Windows%\junkSearcher.exe
pump
false
rootkit
kom5ayw0y7atrq0eif
rootkit_type
junkkit
task_client
ShellHost
task_watchdog
CookieManager
usb_spread
true
use_install_admin
false
user_init
true
winlogon_shell_enable
true
wmi_name
WindowsDefender
wmi_startup
true

Signatures

Family: GomoRAT
GomoRAT is a Windows RAT written in C#.
rat gomorat

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
DataBase.exe

File Explorer

DataBase.exe

.exe 916KB

DataBase.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 ce8d311bc103c8115b7ba8e6d58f4a3827fc53b7be41048beaa4bba67a8531d2
MD5 ea27e69bb910466d13dbb0106a83f76b
SHA1 9d46e4494e39db42dbdf66e89b6e13d8c96f2887
SHA512 c3229ee29c1fd78ea7324d7d9d306895cbe24ded1dddf6067db32d032a68261dc1b91ee6008b3391ba46f1d85d820cd81e9d2e46453f5e6bebb663673a958838
SSDEEP 12288:3Z3xS1ClK3qbw3ByKfRP0lN/JXIiSIOTgzUHKtZZNbmPbZ2xAQtRSBhU:3fSWnwzPJiNlAtol
TLSH
T18D15F86A7B828F49E065687DCCCD3322D7A11FF72323634B3B086714178A1DA9D1B796
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

95:16:d6:40:07:01:cb:b3:65:2e:ba:17:60:49:eb:c5:85:fb:db:15:3b:07:4a:43:b7:94:aa:0c:c9:aa:ed:fb

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=14198230,CN=Crystal Future OÜ,O=Crystal Future OÜ,STREET=Pikk tn 7-5,L=Tallinn,ST=Harju,C=EE,1.2.840.113549.1.9.1=#0c1563656f406372797374616c6675747572652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024545,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 13, 2022

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

PE Signature issue

Digest

95:16:d6:40:07:01:cb:b3:65:2e:ba:17:60:49:eb:c5:85:fb:db:15:3b:07:4a:43:b7:94:aa:0c:c9:aa:ed:fb

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

Chains

Nov 13, 2022

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

33:00:00:00:3b:6a:c0:1e:2b:21:e6:15:dc:00:00:00:00:00:3b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 4, 2015 - Jun 4, 2025

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

68:b5:f9:08:2e:c8:38:ba:1f:19:64:06

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 17, 2021 - Nov 18, 2023

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Serial Number

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

917278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

DataBase.exe

PE Signature issue

PE Signature issue

mscoree

dotnet