General
-
Target
c7d749686aa87a0826f47179002820dd.exe
-
Size
28KB
-
MD5
c7d749686aa87a0826f47179002820dd
-
SHA1
11e6c74a32be6e02d2c7ebb2b10b562cfaa16c9f
-
SHA256
a716b5f8a785fdbd248b36963d8a797083bf9d05dc4ae50b10536dbca81f4301
-
SHA512
7764ead079cd485c5cd2e069b69a8eca80a49f1e80d7a9426d71c5dc648a6e9cf42711255c947951f04dfa2227770714c376b43782d658b0b6826fa14d1fb4fd
-
SSDEEP
384:OB+Sbj6NKEHU637AHtSnGqDC3qSKvDKNrCeJE3WNgjLxC1zdcY2G1jVFQro3lcTe:EpE0637wtt3qSI45NmWdcJaxN7j
Malware Config
Extracted
limerat
-
aes_key
a
-
antivm
true
-
c2_url
https://pastebin.com/raw/CWD9meJm
-
delay
3
-
download_payload
false
-
install
true
-
install_name
winIogon.exe
-
main_folder
AppData
-
pin_spread
true
-
sub_folder
\Local\
-
usb_spread
true
Signatures
-
Limerat family
Files
-
c7d749686aa87a0826f47179002820dd.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ