General
-
Target
New-Client.exe
-
Size
32KB
-
MD5
2146180dc49ec60e67d2a5c0f37d8442
-
SHA1
520c9d701d521f5283f7d47baedb839fd032b26e
-
SHA256
6501e002120abca549f766a970bb2450b1ab29cd48fd59d4e6da1ed9b2422dfa
-
SHA512
8690c9093b1e25fdbfa972223b458fd361a1be199d2f1234ee70385b2923fb25426f0b15fa4ab09c0694f88247878f0dc959ff864cc1bce9555ac6435c8eaa28
-
SSDEEP
768:3vhzSGlLsswZvgM45NVST05MFz8gZc5tunV7KYhJ:/XsgRRMpR/nV7KmJ
Malware Config
Extracted
limerat
-
aes_key
7777
-
antivm
true
-
c2_url
https://pastebin.com/raw/DDTVwwbu
-
delay
3
-
download_payload
false
-
install
false
-
install_name
PanelX.exe
-
main_folder
UserProfile
-
pin_spread
false
-
sub_folder
\Viruses\
-
usb_spread
true
Signatures
-
Limerat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource New-Client.exe
Files
-
New-Client.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ