Extracted

Extracted

Extracted

• • Target

    Rat Testing/Lime Rat.exe

  • Size

    28KB

  • MD5

    457d2e2fabc4243730eb308bb0f4e073

  • SHA1

    7f17f6124dd7271723887350e406240888566db7

  • SHA256

    16502a5eea8d788fc294b7795f5fbb8e10788df361d70d9e842df3f3fd81b775

  • SHA512

    480b2152b2d1d150b9a0de99df0e74c1077e539cf911e59195f78c1b904882ee9ba24530c33f37defd850609881d6376e894e4a4fcbe16425b26adde3863140b

  • SSDEEP

    384:SB+Sbj6NKW3c61lAHdk9GLqDuaywywVJvDKNrCeJE3WNg8/lPnWGrtHAUMQro3lP:IpWM61lwdT9wywVB45NJEGr49j

  Score

  10^/10

  limeratransomwarerat

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat

  • Renames multiple (3426) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1

• • Target

    Rat Testing/Xeno Rat.exe

  • Size

    45KB

  • MD5

    5bf8a2aeedfb1123eb10af5e0f0e3302

  • SHA1

    cdb9c4090f4ff8b9a5d94eaae30c15f4916e177a

  • SHA256

    bf0927a0af35c23071466397ab21b38951d5847a4c7dda419d83a1a98183b12f

  • SHA512

    3fa42409cea75c32b6323567fd7f03f10fd220fd73a93e4ba4d6bf998b228377e404d1a050f32e952b742c8d89a7e2384c14129608814711e285bfad33024983

  • SSDEEP

    768:FdhO/poiiUcjlJInrVH9Xqk5nWEZ5SbTDazuI7CPW5j:bw+jjgnRH9XqcnW85SbT2uIb

  Score

  10^/10

  xenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral2