Extracted

• • Target

    c9bc1fdfd47f19c1af3631334c0687809cb0d4f5307af3037823212539d81c20.exe

  • Size

    262KB

  • MD5

    707a6fa9d0dfc998063525e6697402b1

  • SHA1

    e5a930dab328f46a1f7f9b25115b08a8666616e4

  • SHA256

    c9bc1fdfd47f19c1af3631334c0687809cb0d4f5307af3037823212539d81c20

  • SHA512

    80d682e357f08fd02abfc255000cc4ba0d7b8ca705a850f78822c61fa4c7a702984ca2f8e73500dab33964a43bba7098b16e1a3ad7bb9375f34b698377b878f1

  • SSDEEP

    3072:kJ3DOOITimBCpBigzNm1VD4Uh4iYatRlgpa/hz58O0Bz65/M6If+3Js+3JFkKeTn:WDdb7Tz0T4ihtz8WzYxBt25

  Score

  10^/10

  limeratrat

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2