Overview

overview

10

Static

static

10

4f35e245a5...bd.exe

windows7-x64

10

4f35e245a5...bd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7595d2720aa7240588903df1a84bc840.bin

  • Size

    14KB

  • Sample

    230722-bx637shh31

  • MD5

    4fecc183ecd4417b660c1adf05e640ce

  • SHA1

    f8cf30a6c664d84f949c3c5bad0bfc989667cba3

  • SHA256

    afdd385130c2937340353d667a880a107e027ae7f75aabc59ce9ddabd2ebb77a

  • SHA512

    59aa32b8a0b56145ffec661ef2341d96cfcdbc612afbb7b096eac25922064dc701b4fcc6237dc565aba0381e8a9732287c323046a3f12bd3a93ccf695500d686

  • SSDEEP

    192:TkRCAnVHJy1lnAFHid95Dw51wn6TU8R/lkJ8yP2IF2L36sQd9jB0Ygey:TkRjnNo1dsQD41s6Z/67P2IEmPjB0Y6

Score
10/10
limeratrat

Malware Config

Extracted

Family

limerat

Attributes
  • aes_key

    123

  • antivm

    false

  • c2_url

    https://pastebin.com/raw/bCzwnKS8

  • delay

    3

  • download_payload

    false

  • install

    false

  • install_name

    Wservices.exe

  • main_folder

    Temp

  • pin_spread

    false

  • sub_folder

    \

  • usb_spread

    false

Targets

    • Target

      4f35e245a543eb6888dd7d2d3cd32be839d7925b857d78d3721999c383bb9dbd.exe

    • Size

      28KB

    • MD5

      7595d2720aa7240588903df1a84bc840

    • SHA1

      0fab07f7b35249abb58baf70530c068bcfa18b78

    • SHA256

      4f35e245a543eb6888dd7d2d3cd32be839d7925b857d78d3721999c383bb9dbd

    • SHA512

      f874d27d928fa32e2addd92e17984b7fa91d1d972b3777b8ee7c84812530c4e306850896398d220aa136a1fb031eae0498795ad3ac6bb014489a7ecab4333269

    • SSDEEP

      384:cB+Sbj6NKGnD6N9AHNkAeqDTqfGloavDKNrCeJE3WNgjz9DQWaRQro3lcVObsjr:6pGD6N9wN9qfGa445NwZQWS6j

    Score
    10/10
    limeratrat

    • LimeRAT

      Simple yet powerful RAT for Windows machines written in .NET.

      ratlimerat

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks