General
-
Target
js-beautified-1.js
-
Size
110KB
-
Sample
210823-9d9m1b7z2n
-
MD5
166d32ce24cda5d9d5598fa9701fbff7
-
SHA1
a34f8175087f31c13ec473753aef9b693f2085c2
-
SHA256
cb56d4ee3a8ece6ae7b0f473edd4fbecf3eac002ebeeb1832c467d1a37187d38
-
SHA512
76d982a58335f92a4a057fbaf669f2b76dc54f60e5ccfc7a86050afdfc2a417b3f8971eee176c991c09084dc471b58875cbaaabcd6358ef24bedf48a18a7a231
Static task
static1
Behavioral task
behavioral1
Sample
js-beautified-1.js
Resource
win7v20210410
Malware Config
Extracted
limerat
1Cs8MjxkXtYwkDKypg8i1Vj5nzhANpgC6y
-
aes_key
2249
-
antivm
false
-
c2_url
https://pastebin.com/raw/G9wX4J5m
-
delay
8
-
download_payload
false
-
install
true
-
install_name
player.exe
-
main_folder
AppData
-
pin_spread
false
-
sub_folder
\
-
usb_spread
false
Targets
-
-
Target
js-beautified-1.js
-
Size
110KB
-
MD5
166d32ce24cda5d9d5598fa9701fbff7
-
SHA1
a34f8175087f31c13ec473753aef9b693f2085c2
-
SHA256
cb56d4ee3a8ece6ae7b0f473edd4fbecf3eac002ebeeb1832c467d1a37187d38
-
SHA512
76d982a58335f92a4a057fbaf669f2b76dc54f60e5ccfc7a86050afdfc2a417b3f8971eee176c991c09084dc471b58875cbaaabcd6358ef24bedf48a18a7a231
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-