Overview

overview

10

Static

static

10

557dc87278...d1.exe

windows7-x64

10

557dc87278...d1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    557dc87278badcc381b3eaa0515d9c2599d16ba870019b6caed8c0038597ccd1

  • Size

    28KB

  • Sample

    230311-j6569sag7t

  • MD5

    1149143be51ebdb7464daa2e384579e3

  • SHA1

    9d4494da5b007d3ce6fa0ca75a89e657d3c6d12a

  • SHA256

    557dc87278badcc381b3eaa0515d9c2599d16ba870019b6caed8c0038597ccd1

  • SHA512

    e140ce27f0758e0e9fd5d420cbced7e54f912615f5138abe1d0d68a43dc12b5ee1ba1932920ede7d22328e64d8680f70534fb61c1f2b838d8102bbe12b60ed4c

  • SSDEEP

    384:vB+Sbj6NKkh269tAHNuweSqDy1Yv/rkvDKNrCeJE3WNgy3sTbMEawfj6VGQro3l9:Jpkc69twN9ev/rK45N4TbMjaxbj

Score
10/10
limeratrat

Malware Config

Extracted

Family

limerat

Wallets

3LLtMJPwWo6j6FNpniWefihBdE8iF56xx2

Attributes
  • aes_key

    abc

  • antivm

    false

  • c2_url

    https://pastebin.com/raw/JWXgJFzj

  • delay

    3

  • download_payload

    false

  • install

    false

  • install_name

    Wservices.exe

  • main_folder

    Temp

  • pin_spread

    true

  • sub_folder

    \

  • usb_spread

    true

Targets

    • Target

      557dc87278badcc381b3eaa0515d9c2599d16ba870019b6caed8c0038597ccd1

    • Size

      28KB

    • MD5

      1149143be51ebdb7464daa2e384579e3

    • SHA1

      9d4494da5b007d3ce6fa0ca75a89e657d3c6d12a

    • SHA256

      557dc87278badcc381b3eaa0515d9c2599d16ba870019b6caed8c0038597ccd1

    • SHA512

      e140ce27f0758e0e9fd5d420cbced7e54f912615f5138abe1d0d68a43dc12b5ee1ba1932920ede7d22328e64d8680f70534fb61c1f2b838d8102bbe12b60ed4c

    • SSDEEP

      384:vB+Sbj6NKkh269tAHNuweSqDy1Yv/rkvDKNrCeJE3WNgy3sTbMEawfj6VGQro3l9:Jpkc69twN9ev/rK45N4TbMjaxbj

    Score
    10/10
    limeratrat

    • LimeRAT

      Simple yet powerful RAT for Windows machines written in .NET.

      ratlimerat

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks