General
-
Target
1de541692724005757f82e407461e28b2a7f27d38041fa01e62195f6222fdc33
-
Size
25KB
-
Sample
220612-22dwbsehd5
-
MD5
85da8884dc74b154f352f92972951f43
-
SHA1
ea54269917851d963115a1612e137618eab3ca32
-
SHA256
1de541692724005757f82e407461e28b2a7f27d38041fa01e62195f6222fdc33
-
SHA512
d15fbbb677c49629a47ce63994d88b07d72f0d29a1be7fc799f762c4f5bfddd6bc3449f84e67ab56864bfbc6bc371604463f7ee6a17cb10ff5b12ef563d1cc6e
Static task
static1
Behavioral task
behavioral1
Sample
1de541692724005757f82e407461e28b2a7f27d38041fa01e62195f6222fdc33.exe
Resource
win7-20220414-en
Malware Config
Extracted
limerat
1QFd4321CDxJRovYYNG5f66W8KRNh1UuBv
-
aes_key
6652149
-
antivm
true
-
c2_url
https://pastebin.com/raw/f6Wq7j2H
-
delay
3
-
download_payload
false
-
install
true
-
install_name
Shellters.exe
-
main_folder
AppData
-
pin_spread
false
-
sub_folder
\shel\
-
usb_spread
false
Targets
-
-
Target
1de541692724005757f82e407461e28b2a7f27d38041fa01e62195f6222fdc33
-
Size
25KB
-
MD5
85da8884dc74b154f352f92972951f43
-
SHA1
ea54269917851d963115a1612e137618eab3ca32
-
SHA256
1de541692724005757f82e407461e28b2a7f27d38041fa01e62195f6222fdc33
-
SHA512
d15fbbb677c49629a47ce63994d88b07d72f0d29a1be7fc799f762c4f5bfddd6bc3449f84e67ab56864bfbc6bc371604463f7ee6a17cb10ff5b12ef563d1cc6e
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-