General
-
Target
https://cdn.discordapp.com/attachments/1208968256501583993/1209158180924432445/contexto.rar?ex=65e5e74f&is=65d3724f&hm=9021a81adfbcf884344e75c9dce61d9873b125bb42b8b4db544c355b8c756fa2&
-
Sample
240219-ywnlsscg76
Score
10/10
Malware Config
Extracted
Family
limerat
Attributes
-
aes_key
123
-
antivm
true
-
c2_url
https://pastebin.com/raw/GNTRhv8N
-
delay
3
-
download_payload
false
-
install
true
-
install_name
svchost.exe
-
main_folder
AppData
-
pin_spread
false
-
sub_folder
\
-
usb_spread
false
Extracted
Family
limerat
Attributes
-
antivm
false
-
c2_url
https://pastebin.com/raw/GNTRhv8N
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Targets
-
-
Target
https://cdn.discordapp.com/attachments/1208968256501583993/1209158180924432445/contexto.rar?ex=65e5e74f&is=65d3724f&hm=9021a81adfbcf884344e75c9dce61d9873b125bb42b8b4db544c355b8c756fa2&
Score10/10-
LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-