Overview

overview

10

Static

static

10

KarmaC2.exe

windows7-x64

10

KarmaC2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    KarmaC2.exe

  • Size

    29KB

  • Sample

    230317-bwvnsafg7z

  • MD5

    0004261b01160f4adc3050e3be0a82ff

  • SHA1

    155cacc06654342aa73c3335c2fe10ade7dc6120

  • SHA256

    b2f67b7b8641b924f9679f751d155ec8401d41fc90be278853c1daedfe3f3f8f

  • SHA512

    1ba0126579441d97b384743079412eaee6e773ea65dcb501acc97710eafb12102ced555cf366d0082f406d6108e8bd5a326425fe2766b0b385d709f38e88f15f

  • SSDEEP

    384:4B+Sbj6NKgRO6lpFAHnEmoqDSHGc2keGQvDKNrCeJE3WNgPoNdMfnm5LW6OerudF:mpg06lpFwnAm5kHe45Nz8fm5L3O+Stj

Score
10/10
limeratrat

Malware Config

Extracted

Family

limerat

Wallets

bc1q8n9tez4738fhu4zzv4kk3487ydq3ruagasdt08

Attributes
  • aes_key

    serenityx.ddns.net

  • antivm

    true

  • c2_url

    https://pastebin.com/raw/2mVPRNdY

  • delay

    3

  • download_payload

    true

  • install

    true

  • install_name

    OneDrive.exe

  • main_folder

    AppData

  • pin_spread

    false

  • sub_folder

    \Windows NT\

  • usb_spread

    true

Targets

    • Target

      KarmaC2.exe

    • Size

      29KB

    • MD5

      0004261b01160f4adc3050e3be0a82ff

    • SHA1

      155cacc06654342aa73c3335c2fe10ade7dc6120

    • SHA256

      b2f67b7b8641b924f9679f751d155ec8401d41fc90be278853c1daedfe3f3f8f

    • SHA512

      1ba0126579441d97b384743079412eaee6e773ea65dcb501acc97710eafb12102ced555cf366d0082f406d6108e8bd5a326425fe2766b0b385d709f38e88f15f

    • SSDEEP

      384:4B+Sbj6NKgRO6lpFAHnEmoqDSHGc2keGQvDKNrCeJE3WNgPoNdMfnm5LW6OerudF:mpg06lpFwnAm5kHe45Nz8fm5L3O+Stj

    Score
    10/10
    limeratrat

    • LimeRAT

      Simple yet powerful RAT for Windows machines written in .NET.

      ratlimerat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks