Extracted

• • Target
    DLLiumFix2.3.exe
  • Size 7.8MB
  • SHA256 b93f019f1236dc6b061233d9699f64694beb4e42e4851c565a26d4d2c269a610
  • MD5 61a891db8a0976512824ee1f0d0a4945
  • SHA1 9d737a390664c7a396b43c33016ebd4d2091320b
  • SHA512 9f45c77d2ffd171679b5361f69b30b9897d462e7c898e599e7f770c003e2c767b5370fe4047c0ab0e66a72391d6f3ad7c1c213a21be1493e07edd125c11eb9ab
  • SSDEEP 12288:t1qBrDcDaPUrpV316hSFrsgOD/V5EXLjbi8YaTKhEV1ceT+bDqmfj9ie:tMxDbnhSFr8EXLjbDdKYwDqmp
  • TLSH
    T1A5867BC7A4919B42C0A17E7D43DB1C2907CBA5CA8F3257129F0C6B7332A25A37DAF495
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaret.me/junk_codecosturadiscoveryexecutiongomoratpackerpersistenceprivilege_escalationransomwareratspyware

  • Family: GomoRAT

    GomoRAT is a Windows RAT written in C#.

    ratgomorat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2