Overview

overview

10

Static

static

10

5dca66ed85...60.exe

windows7-x64

10

5dca66ed85...60.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5dca66ed85d02f7fc5d9034b940aa726496110f01005b1f2e751ad72f184d960

  • Size

    25KB

  • Sample

    221130-ryptbacc8v

  • MD5

    ae3a68ee7e23df52eb7127da990e256f

  • SHA1

    48276d7fc01e80f940f6d33a1ceaa8819b456bc8

  • SHA256

    5dca66ed85d02f7fc5d9034b940aa726496110f01005b1f2e751ad72f184d960

  • SHA512

    473038496eaa78c264b93fa2340adfc1be20db9d3aa7614b7aabd99db1a337fbfe82af93e88b17fbe05f7fe49cb45c17b42ed3ba6fe85d1e203f33ea69ebb6b8

  • SSDEEP

    384:xE0WnRVmx97gmtppoPfaJhripJPJp388Pt84kDGlzCTJEUmNY9bro3lcTtmrYDW:8mfhkPi/roPJp3KatNXkwY

Score
10/10
limeratrat

Malware Config

Extracted

Family

limerat

Wallets

1A5HhKJf5KP7t19SyW3LavrhFqRDrPEd2q

Attributes
  • aes_key

    Zimbapf1x

  • antivm

    false

  • c2_url

    https://raw.githubusercontent.com/plasticsurge/respiratory/master/palms

  • delay

    3

  • download_payload

    false

  • install

    true

  • install_name

    Discord.exe

  • main_folder

    AppData

  • pin_spread

    false

  • sub_folder

    \

  • usb_spread

    false

Targets

    • Target

      5dca66ed85d02f7fc5d9034b940aa726496110f01005b1f2e751ad72f184d960

    • Size

      25KB

    • MD5

      ae3a68ee7e23df52eb7127da990e256f

    • SHA1

      48276d7fc01e80f940f6d33a1ceaa8819b456bc8

    • SHA256

      5dca66ed85d02f7fc5d9034b940aa726496110f01005b1f2e751ad72f184d960

    • SHA512

      473038496eaa78c264b93fa2340adfc1be20db9d3aa7614b7aabd99db1a337fbfe82af93e88b17fbe05f7fe49cb45c17b42ed3ba6fe85d1e203f33ea69ebb6b8

    • SSDEEP

      384:xE0WnRVmx97gmtppoPfaJhripJPJp388Pt84kDGlzCTJEUmNY9bro3lcTtmrYDW:8mfhkPi/roPJp3KatNXkwY

    Score
    10/10
    limeratrat

    • LimeRAT

      Simple yet powerful RAT for Windows machines written in .NET.

      ratlimerat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks