limerat | 2cbf63527a0c56cf1cd265f78c2886af195b7635c8ff02c0bb02fc20f2cc1c8d | Triage

Sharing

General

Target

199ecae9fa74c42c5dc46548596bc8bb.exe
Size

99KB
Sample

230316-y7txyscg34
MD5

199ecae9fa74c42c5dc46548596bc8bb
SHA1

a62a99b8ade6b1ce411aaa7a8d3b7c34ce6e285a
SHA256

2cbf63527a0c56cf1cd265f78c2886af195b7635c8ff02c0bb02fc20f2cc1c8d
SHA512

3d522d67e624be389c0b8be227c853a7127075fa2b2e38d2457c9d4a6a287122fa9eb466497f3ef6d3bd5f7430654d7b4e4abe4bbcc244e587027f3645d1b924
SSDEEP

1536:OF4WWMJ7J+GMrFmCxuNCTwChaKExEbbaaYoOgGK:84W/Wbth5bbTmgGK

Score

10^/10

limerat rat

Malware Config

Targets

- Target
  
  199ecae9fa74c42c5dc46548596bc8bb.exe
- Size
  
  99KB
- MD5
  
  199ecae9fa74c42c5dc46548596bc8bb
- SHA1
  
  a62a99b8ade6b1ce411aaa7a8d3b7c34ce6e285a
- SHA256
  
  2cbf63527a0c56cf1cd265f78c2886af195b7635c8ff02c0bb02fc20f2cc1c8d
- SHA512
  
  3d522d67e624be389c0b8be227c853a7127075fa2b2e38d2457c9d4a6a287122fa9eb466497f3ef6d3bd5f7430654d7b4e4abe4bbcc244e587027f3645d1b924
- SSDEEP
  
  1536:OF4WWMJ7J+GMrFmCxuNCTwChaKExEbbaaYoOgGK:84W/Wbth5bbTmgGK
Score

10^/10

limerat rat
- LimeRAT
  Simple yet powerful RAT for Windows machines written in .NET.
  rat limerat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Web Service

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2