limerat | 3d604bb259762a9bd3e000cdb0519abc1f852cdca1fe558f49733373f3e23198 | Triage

Sharing

General

Target

3d604bb259762a9bd3e000cdb0519abc1f852cdca1fe558f49733373f3e23198
Size

147KB
Sample

230129-1cjjvade28
MD5

a33390dc8b84abe30014c46d0f9353cc
SHA1

efbd6b925d943a5973d508acafbe8d5e1a3a9818
SHA256

3d604bb259762a9bd3e000cdb0519abc1f852cdca1fe558f49733373f3e23198
SHA512

15f40830c7847475fe959553bd375c66a994369fb01bed0e983e0b0c8ebe710963b232331bbad90aa384e5e184a5df92711ad8c91edf1880672c7428890e6b81
SSDEEP

3072:I3QT8B4Sv0tElYY28Ts2gawnHv28ifsPUAbGdZd:nTsx08PFYvS

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
IRj3SceatjDfweW/qMMw7g==
antivm
false
c2_url
https://pastebin.com/raw/Pzx225ZB
delay
3
download_payload
false
install
true
install_name
Audio Realtek Driver.exe
main_folder
AppData
pin_spread
true
sub_folder
\Audio Realtek Driver\
usb_spread
false

Targets

- Target
  
  3d604bb259762a9bd3e000cdb0519abc1f852cdca1fe558f49733373f3e23198
- Size
  
  147KB
- MD5
  
  a33390dc8b84abe30014c46d0f9353cc
- SHA1
  
  efbd6b925d943a5973d508acafbe8d5e1a3a9818
- SHA256
  
  3d604bb259762a9bd3e000cdb0519abc1f852cdca1fe558f49733373f3e23198
- SHA512
  
  15f40830c7847475fe959553bd375c66a994369fb01bed0e983e0b0c8ebe710963b232331bbad90aa384e5e184a5df92711ad8c91edf1880672c7428890e6b81
- SSDEEP
  
  3072:I3QT8B4Sv0tElYY28Ts2gawnHv28ifsPUAbGdZd:nTsx08PFYvS
Score

10^/10

limerat rat
- LimeRAT
  Simple yet powerful RAT for Windows machines written in .NET.
  rat limerat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2