Extracted

• • Target

    405cacd2e01aa2630b36a2566d36bb67_JaffaCakes118

  • Size

    3.6MB

  • MD5

    405cacd2e01aa2630b36a2566d36bb67

  • SHA1

    e42272044591bd7cd54221275702bb95aaf74dca

  • SHA256

    55d3d6ed09fa05730edb9372a13567fbc0675eb4815e10cd08478d66bc5b8964

  • SHA512

    515b040525d544051beb05528221259cfc91cb1923acc51f68c5461cd11ebfb2f736a70465d95b891e126a1ec6ff32217a936166714b03517d978c91642ba293

  • SSDEEP

    24576:rc3Ugs6OlCpGmReZ/dZf6cux+U9qYVgCxLWtVrbjJmv+:LLG+U9qYVgCxwL

  Score

  10^/10

  limeratrat

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2