Behavioral task
behavioral1
Sample
47415dc54f54a881e0fdd0c02c26b994cf881af13f849428153ae4e42bc12ed6.exe
Resource
win7-20240508-en
General
-
Target
47415dc54f54a881e0fdd0c02c26b994cf881af13f849428153ae4e42bc12ed6.exe
-
Size
28KB
-
MD5
1bb96e140f557472fc121bd147c7fef2
-
SHA1
f1dca9840d4619ed536c733e618f301748041f82
-
SHA256
47415dc54f54a881e0fdd0c02c26b994cf881af13f849428153ae4e42bc12ed6
-
SHA512
8611b8a6a4eae862d412de1e13047b36cd9854bad75b1e8224a820f91630977908c9e560326da8a538dab097cf51b9407ed17a6050535df6ce98e8bd68b4a48d
-
SSDEEP
768:+pOL6TvwdHRv3Jx5LY45N6voFBANLM37/j:+pJvwdH93JjlWwFBA96
Malware Config
Extracted
limerat
-
aes_key
1111
-
antivm
true
-
c2_url
https://pastebin.com/raw/Qik1mEQY
-
delay
3
-
download_payload
false
-
install
true
-
install_name
WinRAR.exe
-
main_folder
AppData
-
pin_spread
false
-
sub_folder
\System\
-
usb_spread
false
Signatures
-
Limerat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 47415dc54f54a881e0fdd0c02c26b994cf881af13f849428153ae4e42bc12ed6.exe
Files
-
47415dc54f54a881e0fdd0c02c26b994cf881af13f849428153ae4e42bc12ed6.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ