Overview

overview

10

Static

static

1

51a36cbd55...bd.exe

windows7-x64

10

51a36cbd55...bd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    51a36cbd556bcca8b3df6c7ef59e561a2e1a0672abe2033e87712958b07275bd

  • Size

    764KB

  • Sample

    230311-j6xj5agh98

  • MD5

    cac78b51b4ae8c359115955f5611f2a5

  • SHA1

    7f5f6600ba423235b87beb9d47239edc4bbbce48

  • SHA256

    51a36cbd556bcca8b3df6c7ef59e561a2e1a0672abe2033e87712958b07275bd

  • SHA512

    85e176cde37e66728da1e9aeb641ef06ed67b41b95c1cbc4b8c8fcb2411e3632784f1a023acb07aac2363944433767fc044acb1986a83478d658db54f6177b91

  • SSDEEP

    12288:kIAAhJZaF75GF2ibA6Sm/HO5J9MdpNNR36UH+4ahldt8VU2EfPrHLEgkMnJ6PMWT:LAxb8AJovPR36UH+4C6u2E3TzwBT

Score
10/10
limeratrat

Malware Config

Extracted

Family

limerat

Wallets

1LLUV51XQKqq94X965Cc6uGPXeZEGSqCdV

Attributes
  • aes_key

    NYANCAT

  • antivm

    false

  • c2_url

    https://pastebin.com/raw/4pByu6u5

  • delay

    3

  • download_payload

    false

  • install

    false

  • install_name

    Wservices.exe

  • main_folder

    AppData

  • pin_spread

    false

  • sub_folder

    \

  • usb_spread

    true

Targets

    • Target

      51a36cbd556bcca8b3df6c7ef59e561a2e1a0672abe2033e87712958b07275bd

    • Size

      764KB

    • MD5

      cac78b51b4ae8c359115955f5611f2a5

    • SHA1

      7f5f6600ba423235b87beb9d47239edc4bbbce48

    • SHA256

      51a36cbd556bcca8b3df6c7ef59e561a2e1a0672abe2033e87712958b07275bd

    • SHA512

      85e176cde37e66728da1e9aeb641ef06ed67b41b95c1cbc4b8c8fcb2411e3632784f1a023acb07aac2363944433767fc044acb1986a83478d658db54f6177b91

    • SSDEEP

      12288:kIAAhJZaF75GF2ibA6Sm/HO5J9MdpNNR36UH+4ahldt8VU2EfPrHLEgkMnJ6PMWT:LAxb8AJovPR36UH+4C6u2E3TzwBT

    Score
    10/10
    limeratrat

    • LimeRAT

      Simple yet powerful RAT for Windows machines written in .NET.

      ratlimerat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks