General
-
Target
MailRanger.rar
-
Size
193.0MB
-
MD5
523a37d5fae0771d17e6fdfd0d7d57d3
-
SHA1
6922a526480293402a379772214f50eb9ee0dff7
-
SHA256
7f7821072d79a0deb26affbf11a4e73d86bfae4a3ef05f9ae6d41757b06a3617
-
SHA512
184cb02123260a2c2fd2803f6d94d83c4d9c5f3836be0a668745732306cb555da60cfaca5248d4a41d2a130eaa435516dc4f1d17a91ce97526add83876316ed9
-
SSDEEP
6291456:YJP0TDV0zorf6XgTmaqS8Ly1Z0djIDkfVa:YSCcrf6XgTmaemOyN
Score
10/10
Malware Config
Extracted
Family
limerat
Wallets
bc1qyej3qhu680rqc5akxac39r92g6a8g6r4708gyj
Attributes
-
aes_key
Test
-
antivm
true
-
c2_url
https://pastebin.com/raw/FU8V31pM
-
delay
3
-
download_payload
false
-
install
true
-
install_name
system32s.exe
-
main_folder
AppData
-
pin_spread
true
-
sub_folder
\
-
usb_spread
true
Signatures
-
Limerat family
-
Detects Pyinstaller 1 IoCs
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
Files
-
MailRanger.rar
Password: racik mailranger z dc
-
MailRanger/237K HQ Skull.XYZ.txt
-
MailRanger/MailRanger.exe
Password: racik mailranger z dc
91ae93ed3ff0d6f8a4f22d2edd30a58e
Headers
Imports
Sections
-
MailRanger.pyc
-
MailRanger/MailUpdate.exe
Password: racik mailranger z dc
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections
-
MailRanger/Mailranger2.ini
-
MailRanger/Przeczytaj!!!!.txt
-
MailRanger/ServerList
-
MailRanger/how to mail_1.mp4
-
MailRanger/socks4_proxies.txt