Extracted

Extracted

• • Target

    cd348d8f8a74c9ceba525ccbf26a7e70_exe32.exe

  • Size

    1.1MB

  • MD5

    cd348d8f8a74c9ceba525ccbf26a7e70

  • SHA1

    55a371874bf3b68925a9c98fe91aba703aec0bc6

  • SHA256

    a491a0d38b7f90a19b5fea4beb3dd65468517cd424024ea9bbc18524835fc6f7

  • SHA512

    0ce3ba5abd2a4dd3a6d523fffbdc83fc634ffaccf338b3a2ad7677f0d2cfe17da7c94bce8715ce2ceff75b0283ff339fff61ac8ca6a4953bbcf7cb6fa67b96a7

  • SSDEEP

    24576:4AHnh+eWsN3skA4RV1Hom2KXMmHa97aWtjzjFtuM250:/h+ZkldoPK8Ya971XjFtA0

  Score

  10^/10

  limeratrat

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2