Behavioral task
behavioral1
Sample
32696f5d14f82da2b483b853946a88eac8ef47abf8b163446011fd4eb37f06f9.exe
Resource
win7-20230220-en
General
-
Target
32696f5d14f82da2b483b853946a88eac8ef47abf8b163446011fd4eb37f06f9
-
Size
29KB
-
MD5
b14bbd5479f120504684161a942a51e6
-
SHA1
e7e0ebaeea26e10f2dfbc71c3e9e4fe5122d4ec6
-
SHA256
32696f5d14f82da2b483b853946a88eac8ef47abf8b163446011fd4eb37f06f9
-
SHA512
1c93f16b074ccfe1ed124d10b457ae72bf6bdff004f1fad0ed94d396fb975d6486126ee1f12346c6cc7a17f651c456011a5386b6c3aad409bd27144e5a6d5c08
-
SSDEEP
768:szPy6kLTt3dO/cmTCUuMthT36Hslrjy+b:kPkLTtspTzthT36HirjT
Malware Config
Extracted
limerat
-
aes_key
mrrobot
-
antivm
false
-
c2_url
https://pastebin.com/raw/mndrG70y
-
delay
3
-
download_payload
false
-
install
true
-
install_name
yes.exe
-
main_folder
AppData
-
pin_spread
false
-
sub_folder
\pok\
-
usb_spread
false
Signatures
-
Limerat family
Files
-
32696f5d14f82da2b483b853946a88eac8ef47abf8b163446011fd4eb37f06f9.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ