Extracted

• • Target

    a7dc766d2cc28db55a64623e0b02d54b_JaffaCakes118

  • Size

    92KB

  • MD5

    a7dc766d2cc28db55a64623e0b02d54b

  • SHA1

    29978797065feee25ac250ec63ebb38a1b3b9cf5

  • SHA256

    b6118e5a93ae5d2226e32706966d10d49bdad63786cf97fc2f25512d43bbf381

  • SHA512

    10f1f1ae7334aeb48201e41dac2f95f359ff9155b7c377f1035b8e7616affe5db8b79e0e5c2641d40f8502991b705890560918b6fdf9633861b2a3e8462e1318

  • SSDEEP

    1536:StNQi/tQBpNGMerBfcpSHduJ2b4Tds/q/Ykg7CN/tNupiAK+A09l:n+tQBXderqAAAidb/f+2/ug0D

  Score

  10^/10

  limeratrat

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat

  • Limerat family

    limerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2