Overview

overview

10

Static

static

10A30B9776...34.exe

windows7_x64

10

10A30B9776...34.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    10A30B9776BB8981976FE678E4538E68C8FBBB0A57F34.exe
  • Size 537KB
  • Sample210507-9dtefxsngn
  • SHA256 10a30b9776bb8981976fe678e4538e68c8fbbb0a57f34934978b3df7238be8d5
  • MD5 SHA1 SHA512
Score
10/10
limeratoskiinfostealerratspywarestealer

Malware Config

Extracted

Family

  • limerat

Wallets

  • 1CUdxaF2Z2M9DewCbmhsJUwqDJCxMo7mcx

Attributes
  • aes_key

    NYAN

  • antivm

    false

  • c2_url

    https://pastebin.com/raw/SkZ5tGQH

  • delay

    3

  • download_payload

    true

  • install

    true

  • install_name

    update.exe

  • main_folder

    AppData

  • payload_url

    http://bankschannelpub.com/wp-content/upgrade/dll.exe

  • pin_spread

    false

  • sub_folder

    \update\

  • usb_spread

    false

Extracted

Family

  • oski

C2

  • trafficbadassery.com/a/

Targets

    • Target
      10A30B9776BB8981976FE678E4538E68C8FBBB0A57F34.exe
    • Size 537KB
    • SHA256 10a30b9776bb8981976fe678e4538e68c8fbbb0a57f34934978b3df7238be8d5
    • MD5 SHA1 SHA512
    Score
    10/10
    limeratoskiinfostealerratspywarestealer

    • LimeRAT

      Simple yet powerful RAT for Windows machines written in .NET.

      ratlimerat

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

      infostealeroski

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks