Extracted

Extracted

• • Target
    2026-08-13_bcc84c0b485a89e9e3635222cc59af72_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos
  • Size 1.4MB
  • SHA256 663a8eb90c1a5e4f09d6134965f0ca9033a89b5c5cb363e50c64eaff92693bb2
  • MD5 bcc84c0b485a89e9e3635222cc59af72
  • SHA1 7fe1e990fdfb912b9932e4f5ca783a460f7f7425
  • SHA512 66489d13b495eb8f1fbea8855b0f30fd1c8ecfbe2a17b4023765241c09fa9e649ca9991c32225733bb0d20f3f734611557a247d8a5414a33f56f7314dbb16c13
  • SSDEEP 24576:NAHnh+eWsN3skA4RV1Hom2KXSmHdCIOmGK5HyKlUYT5a:sh+ZkldoPKiYd5OjWTlUIa
  • TLSH
    T1F065BF12A797C020FFD39D375B22F205857D6C120A3BD53E42B8BD799AB86E02A5F513
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionlimeratpersistenceprivilege_escalationrat

  • Family: LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2