limerat | e6f2fb615fff28db7ce596bbf614b0ae4dd2c8a0812b0b6370d64fda27b26103 | Triage

Sharing

General

Target

d3501c217e6168565167ab4df2c2e1e6_JaffaCakes118
Size

70KB
Sample

240908-csry6ayhrr
MD5

d3501c217e6168565167ab4df2c2e1e6
SHA1

925f6727b1e54f03232557633ad5f1f86cff51c3
SHA256

e6f2fb615fff28db7ce596bbf614b0ae4dd2c8a0812b0b6370d64fda27b26103
SHA512

2f1ed9501204c83ecbe7695848cedb1f6b8dba835d36115029c06077b1e41b0a9a6cacbe022a7f17a14914753d11ceaa61703890c40b7ee48f90e1e76878054c
SSDEEP

1536:L4gg1oddecOSw1DrXt6njCA6rgLlHBkVY9SoQg65Tt:L4gg1oddecOSYvd6n+A6CHkY9xQf

Score

10^/10

limerat discovery rat

Malware Config

Extracted

Family

limerat

Attributes

antivm
false
c2_url
https://pastebin.com/raw/tB8Ub6Me
download_payload
false
install
false
pin_spread
false
usb_spread
false

Targets

- Target
  
  d3501c217e6168565167ab4df2c2e1e6_JaffaCakes118
- Size
  
  70KB
- MD5
  
  d3501c217e6168565167ab4df2c2e1e6
- SHA1
  
  925f6727b1e54f03232557633ad5f1f86cff51c3
- SHA256
  
  e6f2fb615fff28db7ce596bbf614b0ae4dd2c8a0812b0b6370d64fda27b26103
- SHA512
  
  2f1ed9501204c83ecbe7695848cedb1f6b8dba835d36115029c06077b1e41b0a9a6cacbe022a7f17a14914753d11ceaa61703890c40b7ee48f90e1e76878054c
- SSDEEP
  
  1536:L4gg1oddecOSw1DrXt6njCA6rgLlHBkVY9SoQg65Tt:L4gg1oddecOSYvd6n+A6CHkY9xQf
Score

10^/10

limerat discovery rat
- LimeRAT
  Simple yet powerful RAT for Windows machines written in .NET.
  rat limerat
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

limeratdiscoveryrat

behavioral2

limeratdiscoveryrat