limerat | 865f0c77242db6c8bc7853d56c80df25d0131978cc693fc2a05a392316cfc566 | Triage

Sharing

General

Target

ChromiumUpdateexeexeexeex.exe
Size

44KB
Sample

230709-xy537agb7y
MD5

fda53976d89ab903557b9528cc2fb91d
SHA1

c42781c8328b1dbb70c3571fcadd9f674c5df333
SHA256

865f0c77242db6c8bc7853d56c80df25d0131978cc693fc2a05a392316cfc566
SHA512

7b7f0efd96a67026aea1661fee86358557b89d67ed8c96c9125a61958570e00e9cab2cc84950cdd8eb799cdc8e5f2cdc0d1c90da2b0c891920b700c203e44444
SSDEEP

768:TpYT6H3wjsG/YS445NoDamKOAZB6in1WjctC1iTIPYe:TpH3wj9/ZF8DHoBGgCuIP7

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Wallets

bc1qwycfayk08cnnj2ng0emn8yeek6hkdkdvue952a

Attributes

aes_key
vELKIjFPTOEs91pZ1LF+7gl6DaQq5z3kH6Q5FyFhRO8/6K8Xpl7YLTgTqwUttOW5
antivm
false
c2_url
https://pastebin.com/raw/DDTVwwbu
delay
3
download_payload
false
install
false
install_name
Wservices.exe
main_folder
Temp
pin_spread
true
sub_folder
\
usb_spread
true

Targets

- Target
  
  ChromiumUpdateexeexeexeex.exe
- Size
  
  44KB
- MD5
  
  fda53976d89ab903557b9528cc2fb91d
- SHA1
  
  c42781c8328b1dbb70c3571fcadd9f674c5df333
- SHA256
  
  865f0c77242db6c8bc7853d56c80df25d0131978cc693fc2a05a392316cfc566
- SHA512
  
  7b7f0efd96a67026aea1661fee86358557b89d67ed8c96c9125a61958570e00e9cab2cc84950cdd8eb799cdc8e5f2cdc0d1c90da2b0c891920b700c203e44444
- SSDEEP
  
  768:TpYT6H3wjsG/YS445NoDamKOAZB6in1WjctC1iTIPYe:TpH3wj9/ZF8DHoBGgCuIP7
Score

10^/10

limerat rat
- LimeRAT
  Simple yet powerful RAT for Windows machines written in .NET.
  rat limerat
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Web Service

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2