General
-
Target
bf5ef36eb0ab0ecb25d80207e730177d07961df7b8266167074ddbc3baf5bcb3
-
Size
238KB
-
Sample
221130-sgb2kaah56
-
MD5
440d7a7357b48507cbf9857064638dfd
-
SHA1
fbf4d41cc343cb260d0c320ade3c1271959d6eba
-
SHA256
bf5ef36eb0ab0ecb25d80207e730177d07961df7b8266167074ddbc3baf5bcb3
-
SHA512
ee709aa46f4506aa1ce26d0edcdbf9241749ed154e1a8ab2976b691f95469c8cdef168d59ad27773506e433debb0a28550f113f6bb5b7e1e12c994fcd2aa875c
-
SSDEEP
3072:zTZ5rlD8r5Yg3g7xnyfKUze1zF9Olhc7tmtpsJpQuTejgu3nypr/7Rioqz5HKd/z:zTyYg3AnySQcWlqi1ERio6q2U
Static task
static1
Behavioral task
behavioral1
Sample
bf5ef36eb0ab0ecb25d80207e730177d07961df7b8266167074ddbc3baf5bcb3.exe
Resource
win7-20221111-en
Malware Config
Extracted
limerat
-
aes_key
IRj3SceatjDfweW/qMMw7g==
-
antivm
true
-
c2_url
https://pastebin.com/raw/p8Be8nNX
-
delay
3
-
download_payload
false
-
install
true
-
install_name
Windows Update.exe
-
main_folder
UserProfile
-
pin_spread
false
-
sub_folder
\Windows\
-
usb_spread
false
Targets
-
-
Target
bf5ef36eb0ab0ecb25d80207e730177d07961df7b8266167074ddbc3baf5bcb3
-
Size
238KB
-
MD5
440d7a7357b48507cbf9857064638dfd
-
SHA1
fbf4d41cc343cb260d0c320ade3c1271959d6eba
-
SHA256
bf5ef36eb0ab0ecb25d80207e730177d07961df7b8266167074ddbc3baf5bcb3
-
SHA512
ee709aa46f4506aa1ce26d0edcdbf9241749ed154e1a8ab2976b691f95469c8cdef168d59ad27773506e433debb0a28550f113f6bb5b7e1e12c994fcd2aa875c
-
SSDEEP
3072:zTZ5rlD8r5Yg3g7xnyfKUze1zF9Olhc7tmtpsJpQuTejgu3nypr/7Rioqz5HKd/z:zTyYg3AnySQcWlqi1ERio6q2U
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-