Extracted

• • Target

    c61e10a7b5bcbea57dc615e98382b0c4_JaffaCakes118

  • Size

    129KB

  • MD5

    c61e10a7b5bcbea57dc615e98382b0c4

  • SHA1

    b9165778176a1f7e4262a778f3695b85bb2b649d

  • SHA256

    4f9e164785ec4e2b6f3c5c6bcbf30346b0d84e1c1e8f4374bc2042922287e61c

  • SHA512

    9dc10990b84ac86d4f913b5fa4b6f7e6470dd95737d5e3391b80ab17f9116c8161092da75b31e0db151c93fc8575f6363ab813e4b63b54fab2d8191b177b1ab5

  • SSDEEP

    3072:IdGU+Mq2clTzTANZoXS1yUEOVO1Kbwu84QQY3lqya:Ia2clHTumBI984lY3lq

  Score

  10^/10

  limeratrat

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2