Extracted

• • Target

    fc497d00a5a6e5ac881ae0b2464792d1_JaffaCakes118

  • Size

    87KB

  • MD5

    fc497d00a5a6e5ac881ae0b2464792d1

  • SHA1

    bad62ec1c95a1c3ef9eb7673da72af985a26738a

  • SHA256

    c9e846a5e8b50d5c767f48c53e2b6d9ae21cdfa3093de461b1a6fa5b18a5b368

  • SHA512

    f0a1b7fb4aeabfcfbdc3003a7a07dff48fc2f24946410682ea1ef0ae340d3637243f1a004c3c7f2bcf5f30ca9152ab4a689420d1356125554615aab0acb67866

  • SSDEEP

    1536:GaV40mHKRDh5OMiZM2wrfQw7J2GS4sjvgtCwi3g/Wstk0JmDfzv6ioa6e:GaV4Xqxuu2wkSAGxo3gaivpY

  Score

  10^/10

  limeratrat

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat

  • Limerat family

    limerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2