Behavioral task
behavioral1
Sample
a62bf59b6bf0f1cbfeb62dc7b3270467b8ff9c8fc05a37c4ee1753153817a4d0.exe
Resource
win7-20230220-en
General
-
Target
a62bf59b6bf0f1cbfeb62dc7b3270467b8ff9c8fc05a37c4ee1753153817a4d0
-
Size
32KB
-
MD5
08346bf7d40e477a1e649e04363b1afb
-
SHA1
8261511a0be205fe7e83d0ec1f8cdb2e793cc9cd
-
SHA256
a62bf59b6bf0f1cbfeb62dc7b3270467b8ff9c8fc05a37c4ee1753153817a4d0
-
SHA512
449d2a6d2e4a2b6f6277514177ba5ee6729ee6322134cd8af733bc24ef7c612a158bc51ca2e2524ccb2f17135e639573bf8ce76129cfc9d5886ec8723d4d4d9e
-
SSDEEP
384:mQB+Sbj6NKFRW16lVAH9FYViqqD+VsQXLvDKNrCeJE3WNgRQH6d4J4OQro3lcMxQ:rpF06lVw9qmQX745Nhq04j
Malware Config
Extracted
limerat
1EogL1YUsV2QZTZjvYtV8ZVSDDXLGBGPRi
-
aes_key
user
-
antivm
false
-
c2_url
https://pastebin.com/raw/g0ZuQHkL
-
delay
3
-
download_payload
false
-
install
true
-
install_name
Wservices.exe
-
main_folder
AppData
-
pin_spread
false
-
sub_folder
\
-
usb_spread
false
Signatures
-
Limerat family
Files
-
a62bf59b6bf0f1cbfeb62dc7b3270467b8ff9c8fc05a37c4ee1753153817a4d0.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ