Extracted

• • Target

    8356c52ea1848cddcca3edc7992ab3b0_JaffaCakes118

  • Size

    92KB

  • MD5

    8356c52ea1848cddcca3edc7992ab3b0

  • SHA1

    6c6e39967c236df518a2dcaefb5c51849eaf9afe

  • SHA256

    5b840344bda0f53b83c8d429eaf6673a941bc0455306b72eba72ee4df2762be5

  • SHA512

    3a8b46b29cf5288611bda486c39695f67bcff88f91cd821ae345de071aa1b297366af47fbc5ef579bd6c410f6e1c920d2e4651758e6118caefa407425b09df16

  • SSDEEP

    1536:+tNQi/tQBpNGMerBfcpSHduJ2b4Tds/q/Ykg7CN/tNupiAK+A09l:D+tQBXderqAAAidb/f+2/ug0D

  Score

  10^/10

  limeratrat

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat

  • Limerat family

    limerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2