limerat

General

Target

b021151e316236971da6954e9a96fe7f9d7af1082d1f83ce0e83fea6caf37486
Size

3.8MB
Sample

220625-g4sr2sbeb9
MD5

6d3d9ba1c944e0c0ae366f559a61e497
SHA1

61ba8c88597523562dc86354ebee6476c0d33c6a
SHA256

b021151e316236971da6954e9a96fe7f9d7af1082d1f83ce0e83fea6caf37486
SHA512

3381a6e5891a4d7af3ea07a561c317975fc4060933d9b0821bf4a20f70b529c35cafe27d1d87f6b98e77d62abb9ea9927372df3fcaffa0944a38b7f163e0820d

Score

10^/10

Malware Config

Extracted

Family

warzonerat

C2

grounderwarone.rapiddns.ru:5500

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

seasons444.ddns.net:8128

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
window
keylog_path
%AppData%
mouse_option
false
mutex
Office_vgqkluqlnw
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title

Extracted

Family

limerat

Wallets

1BVfdhbuDbDuMXWErhTv8XwgwYP1K34oTD

Attributes

aes_key
MAXS20
antivm
false
c2_url
https://pastebin.com/raw/vnPLhhBH
delay
3
download_payload
false
install
false
install_name
Wservices.exe
main_folder
AppData
pin_spread
false
sub_folder
\
usb_spread
false

Targets

- Target
  
  b021151e316236971da6954e9a96fe7f9d7af1082d1f83ce0e83fea6caf37486
- Size
  
  3.8MB
- MD5
  
  6d3d9ba1c944e0c0ae366f559a61e497
- SHA1
  
  61ba8c88597523562dc86354ebee6476c0d33c6a
- SHA256
  
  b021151e316236971da6954e9a96fe7f9d7af1082d1f83ce0e83fea6caf37486
- SHA512
  
  3381a6e5891a4d7af3ea07a561c317975fc4060933d9b0821bf4a20f70b529c35cafe27d1d87f6b98e77d62abb9ea9927372df3fcaffa0944a38b7f163e0820d
Score

10^/10

limerat remcos sality warzonerat host backdoor evasion infostealer rat trojan upx
- LimeRAT
  Simple yet powerful RAT for Windows machines written in .NET.
  rat limerat
- Modifies firewall policy service
  evasion
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Windows security bypass
  evasion trojan
- Warzone RAT Payload
  rat
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Suspicious use of SetThreadContext
behavioral1 behavioral2