General
-
Target
AML_Commpliance_pdf.js
-
Size
111KB
-
Sample
210814-xac9l891se
-
MD5
f41c8229b3c54c3ff51191372d9cb790
-
SHA1
c4d57e6f2b94060a94c4f84863a597c2ef58651d
-
SHA256
61b69d2a4ca9404f1a5b73fac4790b0a41c7c7f766ba90d5a459612b629bf9b1
-
SHA512
df6fd5888700d5acc5988821087c7a304e1ceff914320342dd1393f0366c6995828ffd9a82a36b029452215815fdb42e7c7aa9972ef16099fec7d7926a5f6c11
Static task
static1
Behavioral task
behavioral1
Sample
AML_Commpliance_pdf.js
Resource
win7v20210410
Malware Config
Extracted
limerat
1Cs8MjxkXtYwkDKypg8i1Vj5nzhANpgC6y
-
aes_key
2249
-
antivm
false
-
c2_url
https://pastebin.com/raw/G9wX4J5m
-
delay
8
-
download_payload
false
-
install
true
-
install_name
player.exe
-
main_folder
AppData
-
pin_spread
false
-
sub_folder
\
-
usb_spread
false
Targets
-
-
Target
AML_Commpliance_pdf.js
-
Size
111KB
-
MD5
f41c8229b3c54c3ff51191372d9cb790
-
SHA1
c4d57e6f2b94060a94c4f84863a597c2ef58651d
-
SHA256
61b69d2a4ca9404f1a5b73fac4790b0a41c7c7f766ba90d5a459612b629bf9b1
-
SHA512
df6fd5888700d5acc5988821087c7a304e1ceff914320342dd1393f0366c6995828ffd9a82a36b029452215815fdb42e7c7aa9972ef16099fec7d7926a5f6c11
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-