Overview

overview

10

Static

static

3

d255640baa...cb.exe

windows7-x64

10

d255640baa...cb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb

  • Size

    1.2MB

  • Sample

    231127-l9w4wafh3z

  • MD5

    5dcb26cbf1c756d107fdbe32fb41c1c3

  • SHA1

    1def45e69c25fbddcb11858ea9d765ad1ca4e4c5

  • SHA256

    d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb

  • SHA512

    eed9fa1ca7031e7560c857aaa1cb620c0ba2b9e3d7e4cf36a5596da51773ba1bec7135b484d27bda2e682386bc2f8552912aa4a8ba335d8b166ef5ac8ef013b1

  • SSDEEP

    24576:jpHeEsbf+XmWAn5oG8h/NANypdHgSOs1NSV9EDgYoWnC0/vvDJ:Vxszv35GlNAadHw+NSV9EDgNev

Score
10/10
limeratrat

Malware Config

Extracted

Family

limerat

Attributes
  • aes_key

    123

  • antivm

    true

  • c2_url

    https://pastebin.com/raw/Pwvd6TXb

  • delay

    3

  • download_payload

    false

  • install

    true

  • install_name

    Bhop.exe

  • main_folder

    AppData

  • pin_spread

    false

  • sub_folder

    \

  • usb_spread

    true

Extracted

Family

limerat

Attributes
  • antivm

    false

  • c2_url

    https://pastebin.com/raw/Pwvd6TXb

  • download_payload

    false

  • install

    false

  • pin_spread

    false

  • usb_spread

    false

Targets

    • Target

      d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb

    • Size

      1.2MB

    • MD5

      5dcb26cbf1c756d107fdbe32fb41c1c3

    • SHA1

      1def45e69c25fbddcb11858ea9d765ad1ca4e4c5

    • SHA256

      d255640baa010d37fbf434c4ce3b9766a4bc0f642792786ef7b68acf72d6dbcb

    • SHA512

      eed9fa1ca7031e7560c857aaa1cb620c0ba2b9e3d7e4cf36a5596da51773ba1bec7135b484d27bda2e682386bc2f8552912aa4a8ba335d8b166ef5ac8ef013b1

    • SSDEEP

      24576:jpHeEsbf+XmWAn5oG8h/NANypdHgSOs1NSV9EDgYoWnC0/vvDJ:Vxszv35GlNAadHw+NSV9EDgNev

    Score
    10/10
    limeratrat

    • LimeRAT

      Simple yet powerful RAT for Windows machines written in .NET.

      ratlimerat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks