Extracted

• • Target

    f70f4b3725e2cf2143027082b3a778e927b271771bc30fe549d6d3211a84490d.exe

  • Size

    90KB

  • MD5

    e81693f9a731484df8f6731e1f2bbaf2

  • SHA1

    8d7466cb1bb14fcfce6a75249427112b4297f755

  • SHA256

    f70f4b3725e2cf2143027082b3a778e927b271771bc30fe549d6d3211a84490d

  • SHA512

    8debd9d1abd20719b3408713c8438536458ce64374799e279eb2957753e1d8f5cc5a68590042e82e37b19443f46257e2ef1a92e20ca1aed30550f872cb056a20

  • SSDEEP

    1536:j18S+HEBWbsocH3jLUJL4ySLtRvhaOzh4O9h6h91XvDldwCefK:3+kkY0JLl6tGE4kh6hLlr

  Score

  10^/10

  limeratdiscoveryrat

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat

  • Limerat family

    limerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2