General
-
Target
28931c574059113e891a5130dbe61d0d_JaffaCakes118
-
Size
123KB
-
Sample
240706-scnjss1hlj
-
MD5
28931c574059113e891a5130dbe61d0d
-
SHA1
0879598ec6c091aae822654e4516a80b9e763329
-
SHA256
ddbec9c19476fc0a9dcd62250e4b2dde0ea8be7fceb2fbe072d3473dc4bb163f
-
SHA512
ad71bcbb994f121e0e68cc666ea58d231db0f990bbba615df735c8b65bf81835513c8e1a80ff273d87e6e919192887a690ff49e4e9b1d662859e787e389144ae
-
SSDEEP
3072:NdZfxqr6qi7TY07EnQ+rB9VCV0KcqfJkTmor6SAIust7QpUWu7XHF:Ndnqi7TYlnQuvxmXwGpzu7XH
Malware Config
Extracted
limerat
-
antivm
false
-
c2_url
https://pastebin.com/raw/v9J7B6vz
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Targets
-
-
Target
28931c574059113e891a5130dbe61d0d_JaffaCakes118
-
Size
123KB
-
MD5
28931c574059113e891a5130dbe61d0d
-
SHA1
0879598ec6c091aae822654e4516a80b9e763329
-
SHA256
ddbec9c19476fc0a9dcd62250e4b2dde0ea8be7fceb2fbe072d3473dc4bb163f
-
SHA512
ad71bcbb994f121e0e68cc666ea58d231db0f990bbba615df735c8b65bf81835513c8e1a80ff273d87e6e919192887a690ff49e4e9b1d662859e787e389144ae
-
SSDEEP
3072:NdZfxqr6qi7TY07EnQ+rB9VCV0KcqfJkTmor6SAIust7QpUWu7XHF:Ndnqi7TYlnQuvxmXwGpzu7XH
Score10/10-
LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-