Behavioral task
behavioral1
Sample
e513eb020887dd56e85e55803b1afccb24ae116380947993da2e88a71e97be14.exe
Resource
win7-20240903-en
General
-
Target
e513eb020887dd56e85e55803b1afccb24ae116380947993da2e88a71e97be14.exe
-
Size
364KB
-
MD5
259572ceada05b5940a3d81727e1bbb9
-
SHA1
e2306dbbe659272bf699668ed266cd402e4d0d31
-
SHA256
e513eb020887dd56e85e55803b1afccb24ae116380947993da2e88a71e97be14
-
SHA512
d41bce00fdf7af762fb45d7a49df612de721af91461898d462d82358ad90e074539453b7b84cde9675d999534ee784258b0f14465bcf3716cd87c13405cccbcf
-
SSDEEP
6144:nyTcXNIwt7tpWseWcp/Fmo6TAoqmDGclo:nWcHobZ5TT
Malware Config
Extracted
limerat
15o2GcScWkMTUHBbLS2pdvaYbEAs46pEuu
-
aes_key
NadaNasser@1212
-
antivm
true
-
c2_url
https://pastebin.com/raw/YRNWGBMr
-
delay
3
-
download_payload
false
-
install
true
-
install_name
document autorisation.exe
-
main_folder
Temp
-
pin_spread
true
-
sub_folder
\folder\
-
usb_spread
true
Signatures
-
Limerat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e513eb020887dd56e85e55803b1afccb24ae116380947993da2e88a71e97be14.exe
Files
-
e513eb020887dd56e85e55803b1afccb24ae116380947993da2e88a71e97be14.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 335KB - Virtual size: 335KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ