General

  • Target

    tmp

  • Size

    28KB

  • Sample

    220604-xcm1gsfchp

  • MD5

    3d7801d573cab12f3093c219ebfe495c

  • SHA1

    e1ad7be4ba84e44e4ee4339232b984d29c1328d1

  • SHA256

    21b86512de83574c3ad44210d025e93fb28d205cfbd18825da0a64a52063b627

  • SHA512

    844418bee9dfc603211e2b7e989879b97523adc18630f0ea1b8d93377b3d5fd867a19ffd0af0ac3867d35fc5c8231a1abbbf11f24f8784ab6349afd27ac30cc5

Score
10/10

Malware Config

Extracted

Family

limerat

Wallets

bc1qper8ruvxp2dzgqctqtxd24nhea85gy283xmghe

Attributes
  • aes_key

    150797

  • antivm

    true

  • c2_url

    https://pastebin.com/raw/03PEm7js

  • delay

    5

  • download_payload

    false

  • install

    true

  • install_name

    chrome.exe

  • main_folder

    Temp

  • pin_spread

    true

  • sub_folder

    \

  • usb_spread

    true

Targets

    • Target

      tmp

    • Size

      28KB

    • MD5

      3d7801d573cab12f3093c219ebfe495c

    • SHA1

      e1ad7be4ba84e44e4ee4339232b984d29c1328d1

    • SHA256

      21b86512de83574c3ad44210d025e93fb28d205cfbd18825da0a64a52063b627

    • SHA512

      844418bee9dfc603211e2b7e989879b97523adc18630f0ea1b8d93377b3d5fd867a19ffd0af0ac3867d35fc5c8231a1abbbf11f24f8784ab6349afd27ac30cc5

    Score
    10/10
    • LimeRAT

      Simple yet powerful RAT for Windows machines written in .NET.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v6

Tasks