Extracted

• • Target

    c7d749686aa87a0826f47179002820dd.exe

  • Size

    28KB

  • MD5

    c7d749686aa87a0826f47179002820dd

  • SHA1

    11e6c74a32be6e02d2c7ebb2b10b562cfaa16c9f

  • SHA256

    a716b5f8a785fdbd248b36963d8a797083bf9d05dc4ae50b10536dbca81f4301

  • SHA512

    7764ead079cd485c5cd2e069b69a8eca80a49f1e80d7a9426d71c5dc648a6e9cf42711255c947951f04dfa2227770714c376b43782d658b0b6826fa14d1fb4fd

  • SSDEEP

    384:OB+Sbj6NKEHU637AHtSnGqDC3qSKvDKNrCeJE3WNgjLxC1zdcY2G1jVFQro3lcTe:EpE0637wtt3qSI45NmWdcJaxN7j

  Score

  10^/10

  limeratrat

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2