limerat | 0f28ab259bf7fcea70f4fcf53022f0062d2e81ae4073a4870c389f4ed22efc8d | Triage

Sharing

General

Target

0f28ab259bf7fcea70f4fcf53022f0062d2e81ae4073a4870c389f4ed22efc8d
Size

28KB
Sample

240603-xbvc6sgb42
MD5

7d56d6a7a982e07625092cc80311f54b
SHA1

7715c0abcef845315f52241505b9a9a63456dac3
SHA256

0f28ab259bf7fcea70f4fcf53022f0062d2e81ae4073a4870c389f4ed22efc8d
SHA512

20de93cbbe83687d6b575e67473ecffdc2ac35b1b7379d9787b6a0c9cd942e3a8e9a16e5dae61b81e3a8ce173ba80b1b0ea2a64fdf675c4365b0b8ac0f798fdc
SSDEEP

384:EB+Sbj6NKnZm6OiAH5iIxqDncN4v0ar7vDKNrCeJE3WNgyKP5so2iFEQro3lcGVQ:Cpno6Oiw5Kc2vxL45N7KPNFmwj

Score

10^/10

limerat rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
123
antivm
false
c2_url
https://pastebin.com/87BkkfZk
delay
3
download_payload
false
install
false
install_name
Wservices.exe
main_folder
Temp
pin_spread
false
sub_folder
\
usb_spread
false

Targets

- Target
  
  0f28ab259bf7fcea70f4fcf53022f0062d2e81ae4073a4870c389f4ed22efc8d
- Size
  
  28KB
- MD5
  
  7d56d6a7a982e07625092cc80311f54b
- SHA1
  
  7715c0abcef845315f52241505b9a9a63456dac3
- SHA256
  
  0f28ab259bf7fcea70f4fcf53022f0062d2e81ae4073a4870c389f4ed22efc8d
- SHA512
  
  20de93cbbe83687d6b575e67473ecffdc2ac35b1b7379d9787b6a0c9cd942e3a8e9a16e5dae61b81e3a8ce173ba80b1b0ea2a64fdf675c4365b0b8ac0f798fdc
- SSDEEP
  
  384:EB+Sbj6NKnZm6OiAH5iIxqDncN4v0ar7vDKNrCeJE3WNgyKP5so2iFEQro3lcGVQ:Cpno6Oiw5Kc2vxL45N7KPNFmwj
Score

10^/10

limerat rat
- LimeRAT
  Simple yet powerful RAT for Windows machines written in .NET.
  rat limerat
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2