General
-
Target
52a19a9b1fc41e58aa0ffeda8e9711b1c424c58825b084a4a9a378854318920f
-
Size
33KB
-
MD5
54e737644c21402034c863a89de9f785
-
SHA1
fa4aa0237c56c2f787d5eea774d03e0fd30d8405
-
SHA256
52a19a9b1fc41e58aa0ffeda8e9711b1c424c58825b084a4a9a378854318920f
-
SHA512
a549dc83697609441489d6dd7e8efb20fee74d17051f00e1207e3ea3f3fe394b84d5a2317a78e8ef75a5a3f9424eaf10668a93b6b3a5fa33a9f8ceea1e2b8e1a
-
SSDEEP
768:dpHG6XbwtuEEP545NXc3g7lwYmemFjRu:dpXbwtvwuzQg7KYBYN
Malware Config
Extracted
limerat
-
aes_key
Yp3s6v9y$B?E(H+M
-
antivm
false
-
c2_url
https://pastebin.com/raw/hkXuRtp9
-
delay
3
-
download_payload
false
-
install
true
-
install_name
OverTheCounter.exe
-
main_folder
Temp
-
pin_spread
false
-
sub_folder
\otc\
-
usb_spread
false
Signatures
-
Limerat family
Files
-
52a19a9b1fc41e58aa0ffeda8e9711b1c424c58825b084a4a9a378854318920f.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ