Extracted

Extracted

• • Target

    New-Client.exe

  • Size

    25KB

  • MD5

    cdfc36ba42665419295b0c68dde39430

  • SHA1

    6b577e002d35133a846ef05fe03b5b250c37e8d4

  • SHA256

    f55871df9e8ca3a99a34e3b3345fed1daaf371f77b7c0a668a5f34b60fc0ce35

  • SHA512

    6f25cce90d2a0e3bc97db1c8b090c0c6602eb6393c8096ae1774bc1d8bf02e380ed72690917a2eea25f8cdcd5b41ca7d0939720deffec4ef935609d44de01454

  • SSDEEP

    384:CB+Sbj6NKwSs6/DAH92Xyh34EnWb5j4kDhlzCTJEUmNYEYQro3lch1Fnsjr:4pwP6/Dw9FaE+RHtN8i1ej

  Score

  10^/10

  limeratevasionpersistenceransomwarerat

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat

  • Renames multiple (400) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Modifies RDP port number used by Windows

  • Modifies Windows Firewall

    evasion

  • Sets DLL path for service in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Legitimate hosting services abused for malware hosting/C2

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1