limerat | 52a19a9b1fc41e58aa0ffeda8e9711b1c424c58825b084a4a9a378854318920f | Triage

Sharing

General

Target

52a19a9b1fc41e58aa0ffeda8e9711b1c424c58825b084a4a9a378854318920f
Size

33KB
Sample

230106-slvpgaha42
MD5

54e737644c21402034c863a89de9f785
SHA1

fa4aa0237c56c2f787d5eea774d03e0fd30d8405
SHA256

52a19a9b1fc41e58aa0ffeda8e9711b1c424c58825b084a4a9a378854318920f
SHA512

a549dc83697609441489d6dd7e8efb20fee74d17051f00e1207e3ea3f3fe394b84d5a2317a78e8ef75a5a3f9424eaf10668a93b6b3a5fa33a9f8ceea1e2b8e1a
SSDEEP

768:dpHG6XbwtuEEP545NXc3g7lwYmemFjRu:dpXbwtvwuzQg7KYBYN

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
Yp3s6v9y$B?E(H+M
antivm
false
c2_url
https://pastebin.com/raw/hkXuRtp9
delay
3
download_payload
false
install
true
install_name
OverTheCounter.exe
main_folder
Temp
pin_spread
false
sub_folder
\otc\
usb_spread
false

Targets

- Target
  
  52a19a9b1fc41e58aa0ffeda8e9711b1c424c58825b084a4a9a378854318920f
- Size
  
  33KB
- MD5
  
  54e737644c21402034c863a89de9f785
- SHA1
  
  fa4aa0237c56c2f787d5eea774d03e0fd30d8405
- SHA256
  
  52a19a9b1fc41e58aa0ffeda8e9711b1c424c58825b084a4a9a378854318920f
- SHA512
  
  a549dc83697609441489d6dd7e8efb20fee74d17051f00e1207e3ea3f3fe394b84d5a2317a78e8ef75a5a3f9424eaf10668a93b6b3a5fa33a9f8ceea1e2b8e1a
- SSDEEP
  
  768:dpHG6XbwtuEEP545NXc3g7lwYmemFjRu:dpXbwtvwuzQg7KYBYN
Score

10^/10

limerat rat
- LimeRAT
  Simple yet powerful RAT for Windows machines written in .NET.
  rat limerat
- Executes dropped EXE
- Legitimate hosting services abused for malware hosting/C2
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Web Service

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1