Extracted

• • Target

    93a51bb3d03a1cebf76e63d8bdb3af04

  • Size

    684KB

  • MD5

    93a51bb3d03a1cebf76e63d8bdb3af04

  • SHA1

    0868306dcb3a1f21fdda94e7125ad3aa2ad2dfa9

  • SHA256

    729782176df07dcab88ca6d476c8b78b6b78a104d5df713a526cbf8baad1ddb5

  • SHA512

    17c69bdbfbe71e80dbca83b967b6d9d77a4f63e0ea46b4c418ed7b3f318cda4603c8245b06a4d67a897baf8d8c2899bfb5da2932b0aea52d8c217752eeccc830

  • SSDEEP

    12288:0JOpPEhZTl8pBRxhHLMmyLgIO3GsaMJcR/Vn+R9KVYszf:0JyPEhZB8pBlHomy0IO3GsId+R9KV1f

  Score

  10^/10

  limeratagilenetevasionrattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2