limerat | cad4b9b3faba5b2f535fc4e873e37b81ba38cd5a02e5d8eb2e344e34c1bd1f7a | Triage

Sharing

General

Target

cad4b9b3faba5b2f535fc4e873e37b81ba38cd5a02e5d8eb2e344e34c1bd1f7a
Size

147KB
Sample

230129-1ce7esde24
MD5

cff2d790319ab17e0a5c50cd472ff240
SHA1

e58cf042b5ad0f69adfbe75c9fb9964c74642cf4
SHA256

cad4b9b3faba5b2f535fc4e873e37b81ba38cd5a02e5d8eb2e344e34c1bd1f7a
SHA512

4d8023912869d6ac7ac3b88c452a79104bb0ce39c2284df0ba02439d3d7dba6b776a86354b0eeb44d721a8007d0fe2eb2bb4a8ee66b24b5b2d0110f4440f343c
SSDEEP

3072:73QT8B4Sv0tElYY28Ts2gawnHv28ifsPUAbGdZq:8Tsx08PFYvS

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
IRj3SceatjDfweW/qMMw7g==
antivm
false
c2_url
https://pastebin.com/raw/Pzx225ZB
delay
3
download_payload
false
install
true
install_name
Audio Realtek Driver.exe
main_folder
AppData
pin_spread
true
sub_folder
\Audio Realtek Driver\
usb_spread
false

Targets

- Target
  
  cad4b9b3faba5b2f535fc4e873e37b81ba38cd5a02e5d8eb2e344e34c1bd1f7a
- Size
  
  147KB
- MD5
  
  cff2d790319ab17e0a5c50cd472ff240
- SHA1
  
  e58cf042b5ad0f69adfbe75c9fb9964c74642cf4
- SHA256
  
  cad4b9b3faba5b2f535fc4e873e37b81ba38cd5a02e5d8eb2e344e34c1bd1f7a
- SHA512
  
  4d8023912869d6ac7ac3b88c452a79104bb0ce39c2284df0ba02439d3d7dba6b776a86354b0eeb44d721a8007d0fe2eb2bb4a8ee66b24b5b2d0110f4440f343c
- SSDEEP
  
  3072:73QT8B4Sv0tElYY28Ts2gawnHv28ifsPUAbGdZq:8Tsx08PFYvS
Score

10^/10

limerat rat
- LimeRAT
  Simple yet powerful RAT for Windows machines written in .NET.
  rat limerat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2