Overview

overview

10

Static

static

3

bad2ec084e...18.exe

windows7-x64

10

bad2ec084e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bad2ec084ea758ffaee29bdfa308fd6f_JaffaCakes118

  • Size

    117KB

  • Sample

    240823-h7xe3s1fpg

  • MD5

    bad2ec084ea758ffaee29bdfa308fd6f

  • SHA1

    498bfa6f710863b7436860dab7170f0974a9aa04

  • SHA256

    ba85bfb947e994fef31ff3bfa1569192bd683a259b989997d46aa50389fc0d99

  • SHA512

    8a1d252b1de928954156341998f7d07801868ebac0ce4275b972a849a623209358f339b290d9e42ec2538df23464b21a135c99490b6ae32b881e2dba88e148b1

  • SSDEEP

    3072:ZIkuTX06IqC7YyG1CsZN2AtztkLr8Pztspg8huVL:u/ZCkydFXGAg

Score
10/10
limeratdiscoveryrat

Malware Config

Extracted

Family

limerat

Attributes
  • antivm

    false

  • c2_url

    https://pastebin.com/raw/SKyptWbF

  • download_payload

    false

  • install

    false

  • pin_spread

    false

  • usb_spread

    false

Targets

    • Target

      bad2ec084ea758ffaee29bdfa308fd6f_JaffaCakes118

    • Size

      117KB

    • MD5

      bad2ec084ea758ffaee29bdfa308fd6f

    • SHA1

      498bfa6f710863b7436860dab7170f0974a9aa04

    • SHA256

      ba85bfb947e994fef31ff3bfa1569192bd683a259b989997d46aa50389fc0d99

    • SHA512

      8a1d252b1de928954156341998f7d07801868ebac0ce4275b972a849a623209358f339b290d9e42ec2538df23464b21a135c99490b6ae32b881e2dba88e148b1

    • SSDEEP

      3072:ZIkuTX06IqC7YyG1CsZN2AtztkLr8Pztspg8huVL:u/ZCkydFXGAg

    Score
    10/10
    limeratdiscoveryrat

    • LimeRAT

      Simple yet powerful RAT for Windows machines written in .NET.

      ratlimerat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks