limerat | b8bd1f2001371580a5d4ec4ede4878a2fd564a349e0cf66422bba7f0870e4f22 | Triage

Sharing

General

Target

84890393814f5b5f09d7f41d6f0a90d6
Size

276KB
Sample

231226-w7tabagccr
MD5

84890393814f5b5f09d7f41d6f0a90d6
SHA1

9718f38173cb56d3ea7b2bf5893c61bc77810efd
SHA256

b8bd1f2001371580a5d4ec4ede4878a2fd564a349e0cf66422bba7f0870e4f22
SHA512

2d5e149035f731af62b9a7cc69a039a4b620e639e994b027e1b90e74a65cd5adc4a6fa0e8e351c09257b09d619d9523a9833925bbf929f2d4e2bfa748d96d50e
SSDEEP

3072:x+CCSpjGZodtSu2XkePqH1A0feINRDpepu/VeprFUU5jpPPxhkjXlj:QbYjGCSuykaoXfKsVepaUVnfYX

Score

10^/10

limerat rat

Malware Config

Targets

- Target
  
  84890393814f5b5f09d7f41d6f0a90d6
- Size
  
  276KB
- MD5
  
  84890393814f5b5f09d7f41d6f0a90d6
- SHA1
  
  9718f38173cb56d3ea7b2bf5893c61bc77810efd
- SHA256
  
  b8bd1f2001371580a5d4ec4ede4878a2fd564a349e0cf66422bba7f0870e4f22
- SHA512
  
  2d5e149035f731af62b9a7cc69a039a4b620e639e994b027e1b90e74a65cd5adc4a6fa0e8e351c09257b09d619d9523a9833925bbf929f2d4e2bfa748d96d50e
- SSDEEP
  
  3072:x+CCSpjGZodtSu2XkePqH1A0feINRDpepu/VeprFUU5jpPPxhkjXlj:QbYjGCSuykaoXfKsVepaUVnfYX
Score

10^/10

limerat rat
- LimeRAT
  Simple yet powerful RAT for Windows machines written in .NET.
  rat limerat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2