Extracted

• • Target
    fhuiopufoiupiouef.exe
  • Size 873KB
  • SHA256 1bec077b92368adff15012734e402346ef6035e7c0e8319f4c124185227544c2
  • MD5 4bf0200715b47738b42fe5d2704947e5
  • SHA1 6fdd8dd69ce67c61b1a017c2a0bef48d4d653244
  • SHA512 e23f23952024d82e2efee425e20aeda011ea62124b727a5e2d9546f8dae05c0b23ebb365ff3124b1a0aca4a5b0e3e2ef0bf5a5a0e40e7b86fdb24cba9e9cb96f
  • SSDEEP 12288:ljhUUVITC/fTwJWFaSYGwjJdbEY1v2qU84/s7Oz69XdTMh/JLbq30X8z8a:dhHIqi2YLtdb7qa
  • TLSH
    T11C15E75A7B828F09E075693DCCCD3322D7A51FF32323A34B3B086714178A5DA9D1A796
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaret.me/junk_codecosturadefense_evasiondiscoveryexecutiongomoratpackerpersistenceprivilege_escalationransomwareratspyware

  • Family: GomoRAT

    GomoRAT is a Windows RAT written in C#.

    ratgomorat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2