Overview

overview

10

Static

static

3

fb8afa9be7...18.exe

windows7-x64

8

fb8afa9be7...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118

  • Size

    1.7MB

  • Sample

    240928-fjn3paxhmp

  • MD5

    fb8afa9be7cd9b09165d39421503ebfd

  • SHA1

    2919894445553dae0a5f97697cb5db0df965166e

  • SHA256

    ef2a510aa2f3657c32deab53ec3fc80edd2bec58ac0da22e095513884e7043bc

  • SHA512

    ba102f2e15540ade3990b82982be66b53db728d4929486477f63246646fc5559c294c5abb4cafdd989cf4adca090bdd5dd250c8ed38bb24a8e08e80e2cf824b3

  • SSDEEP

    24576:Ak70TrcTvLK7koq/KtGm0kaSv/o+6207Bh9n1bUPrYTDpGEQ097U2T/DPFraw5kp:AkQTATTK73uSo37Bh968DpG+97U2TDAl

Score
10/10
limeratdiscoveryexecutionrat

Malware Config

Targets

    • Target

      fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118

    • Size

      1.7MB

    • MD5

      fb8afa9be7cd9b09165d39421503ebfd

    • SHA1

      2919894445553dae0a5f97697cb5db0df965166e

    • SHA256

      ef2a510aa2f3657c32deab53ec3fc80edd2bec58ac0da22e095513884e7043bc

    • SHA512

      ba102f2e15540ade3990b82982be66b53db728d4929486477f63246646fc5559c294c5abb4cafdd989cf4adca090bdd5dd250c8ed38bb24a8e08e80e2cf824b3

    • SSDEEP

      24576:Ak70TrcTvLK7koq/KtGm0kaSv/o+6207Bh9n1bUPrYTDpGEQ097U2T/DPFraw5kp:AkQTATTK73uSo37Bh968DpG+97U2TDAl

    Score
    10/10
    discoveryexecutionlimeratrat

    • LimeRAT

      Simple yet powerful RAT for Windows machines written in .NET.

      ratlimerat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks