Overview

overview

10

Static

static

3

a6d2258a95...f9.exe

windows7-x64

10

a6d2258a95...f9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e53ec50faafe4ead0811effbfc09951d886e42cb0725edade77f8487fe8e2b55

  • Size

    30KB

  • Sample

    240831-swbpca1cmj

  • MD5

    80be08249e1a3285ded3e25d3665ea77

  • SHA1

    ee0481df800445582a39735b76a7d5c5868bf634

  • SHA256

    e53ec50faafe4ead0811effbfc09951d886e42cb0725edade77f8487fe8e2b55

  • SHA512

    c1d96b562a0b6cc7083ab9b57de74654d031ca2f67f1e603fa4f3370259284d64b0c3bf015f41bcd9e2e7577dc68ccaf06670fb375ad5b80d1ae728f9e2c5f6e

  • SSDEEP

    768:3WE3FOe6UeG8AE+2GVio2qB0cy41mcIf4GqwQ6:3hOe6U1ypGIpqBvmcIf4GQ6

Score
10/10
limeratdiscoveryrat

Malware Config

Extracted

Family

limerat

Attributes
  • antivm

    false

  • c2_url

    https://pastebin.com/raw/sf0NTYv4

  • download_payload

    false

  • install

    false

  • pin_spread

    false

  • usb_spread

    false

Targets

    • Target

      a6d2258a956d6f8f3d2fd401fa7d519c1c97cd37ba971c4949b981ce221ce5f9

    • Size

      254KB

    • MD5

      ecc1fb4b0c9b8d5492385210ede743e0

    • SHA1

      4eb78421227c33aaba01c70158906b3de99b0e81

    • SHA256

      a6d2258a956d6f8f3d2fd401fa7d519c1c97cd37ba971c4949b981ce221ce5f9

    • SHA512

      3eb9d2f2f9481dad5f4783a23e67b7dea047a2f460e4e880280c9f3b6d9851eac21ff14452ada7774d44e6dea80e1b7e8fdd351ab7da128cfab123e7c9ab4400

    • SSDEEP

      768:lMf0qZPxBXr178NYvGDdHIpT9SBG0B9FN48jt2VHtecomotDhI7xc5DzSEo6LFcU:IY664EB

    Score
    10/10
    limeratdiscoveryrat

    • LimeRAT

      Simple yet powerful RAT for Windows machines written in .NET.

      ratlimerat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks