Extracted

• • Target

    9351225580e96c3d3dea697bd45f2d98_JaffaCakes118

  • Size

    152KB

  • MD5

    9351225580e96c3d3dea697bd45f2d98

  • SHA1

    58566c9a1262082fd24ddfadfe81c07d541f4775

  • SHA256

    7e93fe0e52fe165a5cd2660c5ace9e5f164d1dfc25b9289ee222ab1ac2c13db8

  • SHA512

    ecd71dd8c1953fd590d499d9b67cb42d452e4fe37797d402ae75ea33735ffeb1404479466447b33b86b83473f9d4b202fd99bf4a92f08600d2f061cc2121e72c

  • SSDEEP

    1536:Br1SsHfNDRRMVAzyufQ3Fmo2Y72K6JhQos+Nbz/qz:nLdQpuYiq2phQg/I

  Score

  10^/10

  limeratdiscoveryrat

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat

  • Limerat family

    limerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2