Overview

overview

10

Static

static

URLScan

urlscan

1

https://gofile.io/d/...

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    https://gofile.io/d/ifZLuM

  • Sample

    220203-kh5fhaefdm

Score
10/10
ardamaxlimeratneshtasnakebotagilenetevasionkeyloggerpersistencepyinstallerratsnakebotspywarestealerthemidatrojan

Malware Config

Extracted

Family

limerat

Attributes
  • aes_key

    blunts

  • antivm

    true

  • c2_url

    https://pastebin.com/raw/1NRAsuVh

  • delay

    3

  • download_payload

    false

  • install

    true

  • install_name

    FortniteAimbotESP.exe

  • main_folder

    Temp

  • pin_spread

    false

  • sub_folder

    \

  • usb_spread

    true

Targets

    • Target

      https://gofile.io/d/ifZLuM

    Score
    10/10
    ardamaxlimeratneshtasnakebotagilenetevasionkeyloggerpersistencepyinstallerratsnakebotspywarestealerthemidatrojan

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Detect Neshta Payload

    • LimeRAT

      Simple yet powerful RAT for Windows machines written in .NET.

      ratlimerat

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • SnakeBOT

      SnakeBOT is a heavily obfuscated .NET downloader.

      snakebot

    • Contains SnakeBOT related strings

      snakebot

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

2
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

5
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

6
T1082

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks