Extracted

• • Target
    64rl14zt27ex5n17.exe
  • Size 808KB
  • SHA256 5196386596ba1e425822935bd59293e79f92a976235af59ef05412f48206dc2b
  • MD5 69ab73d57e0b7a94f169d0cc83e89eb3
  • SHA1 4b3c9752685ff64dc3f4bc7f792d1f63f97512e1
  • SHA512 dcf3b30badb32233de28f3e8ce13c281fc2fdd3b2169f61880779892ed8ed6da545cfc18219ae490d7e45644477e20f91b1d0e1fe3f7d42a879da8c26868e1fd
  • SSDEEP 12288:TQ7oLu0I+LxWnoTi5nrVBhW2MjkUprdSzBvKMvEjKIP:y9m+MibUudKj
  • TLSH
    T1AF05D7AA7B828F09E065683DCCCD3312D7A11FF72333634B3B086714168A5DA9D5A7D6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaret.me/junk_codecollectioncosturadefense_evasiondiscoveryexecutiongomoratpackerpersistenceprivilege_escalationransomwareratspywarestealer

  • Family: GomoRAT

    GomoRAT is a Windows RAT written in C#.

    ratgomorat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Modifies AppInit DLL entries

    Modifies the AppInit_DLLs registry setting, allowing a specified DLL to be loaded automatically into almost every Windows process across reboots.

    persistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops file in System32 directory

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2