limerat | 1ac44eda1cc529647ffc10722a39e11da7c0cc9cff19b773a3af07f4baf7d664 | Triage

Sharing

General

Target

1ac44eda1cc529647ffc10722a39e11da7c0cc9cff19b773a3af07f4baf7d664.exe
Size

29KB
Sample

221030-q4fl6adaf8
MD5

051a8439814976290735c9b8159ff602
SHA1

f317839ee7d3fbd9aeeda61aee79787093b1368f
SHA256

1ac44eda1cc529647ffc10722a39e11da7c0cc9cff19b773a3af07f4baf7d664
SHA512

739f7bc18816b45eec85e8955a8e64734cd12059b537ba57f66c78c0625b6bcea793d9fc39739684e4f2a666636b70c5dffb4d6712d536e86f73e2c89b42346d
SSDEEP

384:OB+Sbj6NKgpi6h/AHHkQXOqDttYLmHvDKNrCeJE3WNgURSBe3Qua0U7Hb+8CDIQ5:EpgI6h/wHhtYLmP45NZyY/MHtgiij

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Wallets

bc1q233hm2e03j09e5zy52zqzt0sh7temfq9h4t3cl

Attributes

aes_key
T3rr1f13r
antivm
false
c2_url
https://pastebin.com/raw/BhUB9EXY
delay
3
download_payload
false
install
true
install_name
scvhost.exe
main_folder
UserProfile
pin_spread
false
sub_folder
\scvhostLog\
usb_spread
false

Targets

- Target
  
  1ac44eda1cc529647ffc10722a39e11da7c0cc9cff19b773a3af07f4baf7d664.exe
- Size
  
  29KB
- MD5
  
  051a8439814976290735c9b8159ff602
- SHA1
  
  f317839ee7d3fbd9aeeda61aee79787093b1368f
- SHA256
  
  1ac44eda1cc529647ffc10722a39e11da7c0cc9cff19b773a3af07f4baf7d664
- SHA512
  
  739f7bc18816b45eec85e8955a8e64734cd12059b537ba57f66c78c0625b6bcea793d9fc39739684e4f2a666636b70c5dffb4d6712d536e86f73e2c89b42346d
- SSDEEP
  
  384:OB+Sbj6NKgpi6h/AHHkQXOqDttYLmHvDKNrCeJE3WNgURSBe3Qua0U7Hb+8CDIQ5:EpgI6h/wHhtYLmP45NZyY/MHtgiij
Score

10^/10

limerat rat
- LimeRAT
  Simple yet powerful RAT for Windows machines written in .NET.
  rat limerat
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1