limerat | c948b48bc12b31bcf63322793938fe0f633766cf28b7949ff4f6511f2ebf8256

Sharing

Copy URL Twitter E-mail

General

Target
LimeRAT v0.9.1.7z
Size 3.2MB
Sample261011-2vffksst2l
SHA256 c948b48bc12b31bcf63322793938fe0f633766cf28b7949ff4f6511f2ebf8256
MD5 07a87fde900cbf711336b7eddd6b5849
SHA1 352147aa2c70005b7b7d39bbfba01c7b1f4656e1
SHA512 d52a6828f1984318ea0526ac36aec6a53aebb34e2d0634c9db136c7f5d03620c0ff709a090d8b89e6f19f6c1c539cac04b2f8cd039307a7d79521d814e0d84b5
SSDEEP 49152:aKf+2E4Fp1Ux+Fzk1g0pmoT1P7b/iga7LUfJRXrlWMUxtADrD6T3CMXFs:jm2E4FjUJVpza7LUTrlbUxtA/0Xm
TLSH
T162E533E9019CFBC3ACF5C16EA0E9CEF7A42957AFC53089DB063086B87352129913975D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

limerat

Attributes

aes_key
ase
antivm
true
c2_url
https://pastebin.com/raw/DDTVwwbu
delay
3
download_payload
false
install
false
install_name
Wservices.exe
main_folder
Temp
pin_spread
true
sub_folder
\
usb_spread
true

Extracted

Family

limerat

Attributes

antivm
false
c2_url
https://pastebin.com/raw/9kHA6nwH
download_payload
false
install
false
pin_spread
false
usb_spread
false

Targets

- Target
  LimeRAT v0.9.1/LimeRAT.exe
- Size 7.1MB
- SHA256 21f28da818acb238b9d08d7c746aa5cee2ca028e7b935ada65945ba20bde64a4
- MD5 0f7c026aa7fd009773c99a35d242ae05
- SHA1 2854eb57a1fb7062a43fece33f924d6b24ba1425
- SHA512 2483a8a7c53504bf1b2a87d50f1860f6b2700d3b46db42f418196b987bc378c2be833018f105ea70f3523d0d0bd053883256c421e573afbb673b9b48c6161124
- SSDEEP 98304:+feKeTLa67dos6bI0LO6rAXeb+N99rPmpVzY+QubLmok3VH:+fe/TB7Z0/wL99rPm1QubLmoU5
- TLSH
  T15D76D452BF40E851C4343ABF3E204EC8526B7D989F2652F33141B77D29F89F1AA982D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution limerat rat
- Family: LimeRAT
  Simple yet powerful RAT for Windows machines written in .NET.
  rat limerat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1
- Target
  LimeRAT v0.9.1/LimeRAT.exe.config
- Size 4KB
- SHA256 c9bd2e2628a9fb7dcafbb0f30430a74eb003fb1c19ebc5bcbcff7e072c4dc0ea
- MD5 64f28b753cffe63facd13529b222bdb8
- SHA1 1996851dc1a619d81a7e80af8d053190856b58eb
- SHA512 6362c250a96e7a9b343246fdf619f7911082360a59ad98a5d93c6c1ea7d4002b3cc01575f135a029604009e8a5f0ba51f751520d0da4a6ad3e5e293a6142d7bb
- SSDEEP 48:cnkr7H1W7Hq8SsiYc4qNglvU7mTgrbHAdsu1MpxHHA0iHANHAifHA0HAioB5pqxv:Xr787KTYBhs79rjAiLAFAlAkAEA8Zsa
- TLSH
  T110913B48B5F5DEAA01476632AA3056859EF006771279B0F8B8FC71945F50CCA8BA33B8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral2
- Target
  LimeRAT v0.9.1/MetroFramework.Fonts.dll
- Size 656KB
- SHA256 e96030fddaf7e78401567ee82480ad75ee48d3556199a3f85c0ec669edac2ef4
- MD5 612080028164b12939751dcccbb68d4a
- SHA1 db066593c63d2eff41a5af1b49a3e098b60e0013
- SHA512 1879c960e27e32941c0c992b84803e7a1f8d243bfc88d17d3d32baca772290b9ea60a6ea90d53170be3bf7f0a58fe71ec901dc66aa560b4bf68b1da56c09fe18
- SSDEEP 12288:H+/9JcJlYqCNktA+SXfGpq2fHowSqCNktA+SXfvJR9FrIJJaqCNktA+SXfUC:H+/3qlrCNoh+UqgIwhCNoh+JR9FrIJJw
- TLSH
  T1BDE429B5760139E6EF11C4B7C260FD80192B7863A77B802A68E3077A88575CDFE53E46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  LimeRAT v0.9.1/MetroFramework.dll
- Size 149KB
- SHA256 baf326f52d39155d722465947f4cc67e6e90cfd0f89954eab959568e9bc342aa
- MD5 44538b311e9ec2bcf0a6452702628d99
- SHA1 da67301539903775708e9ec913654851e9e8eade
- SHA512 b65e3bc1c0f7b4c8f778cf52a36d628301d60aab53fdaf0355163e4865bc3d3adbf8870bb6cefc604708fdf2c0e72258eaf2fe301d524af2f77bc08014c9610a
- SSDEEP 3072:LU0T+erz8jYxYg5lzrPHlMUzxXd4kRZPI9q:vT+erz8jYxYgv/lxXGWPS
- TLSH
  T139E33B21770D457FC6BF4A7AF0A12492C3B0DC51FA7BDF5D5C82A29C989B794AE01283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  LimeRAT v0.9.1/Misc/Plugins/CRYP.dll
- Size 15KB
- SHA256 e890f6d0b08bdf34afa3fbe679964b751942a7468cbed79643e12412d3a0d90e
- MD5 fae6c90a20a01e807074b63e7442a9e7
- SHA1 c14872717d08235b4ff9d4815992f1ebb51f495c
- SHA512 61ab5f48db5b306f3eca71d945d29e5101b7299b9b73230a5b656fd2a1c886aab4f49cd0d20c15461abbca2865c4cde5a9f156cfca5b56588560e821c85be526
- SSDEEP 384:jUSg5rnE64MvptUIH1HmDhpQHmczLZ0sGBp/Wk:jUSg5rnE64M/UIVHm+p0sG
- TLSH
  T193620A60B3D4433BC2ED0A754D72A16147B1E74D9922FF6E9CC8A0CA0AA36594780FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  LimeRAT v0.9.1/Misc/Plugins/DDOS.dll
- Size 15KB
- SHA256 7bf43f897a21eea2940868d922938e77a981aad99b71e2bdfeaf46df1d7795b0
- MD5 aecbe15ad47267028248ba2764f2664b
- SHA1 069fb977388e711aece591f6f3b8aca0388d45ab
- SHA512 5c32f29da9102b480879aa294abecb863c5cdd3608adff99631b088c95f05aa9df6bc879e32d8c0e6a66ee9f59bf9d6719bfeca5c70c2971fc6c9bee34a39e5e
- SSDEEP 384:q81guin6gszYCxUWFKP6lIpQa2UqhZQQxS9K2Nkz/WE:q81groYpyXQQcHNkL
- TLSH
  T18B62E7057BE08233CAFD0BB50DA353114B72EB078936FB6D049C605A8A77F819972B76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  LimeRAT v0.9.1/Misc/Plugins/DEC.dll
- Size 17KB
- SHA256 8fe52bdb56a7f279d39fdd0d2f31d78226ef8dcedfa0895c8738934cca8e7007
- MD5 724472f8f2f9a0ef4161afc18d756c51
- SHA1 dbc26a8d535527181a851b4ab979b26ada2b4f4a
- SHA512 8e98d6620a6996be7b248822b3bb264bf72f74c340250ae68b21080af70f7da14e2d2b636fcdd8f5e8628b2649a774189ffa9e64a04bc8f22f2ba921476cd72d
- SSDEEP 384:kg8Y/DYiYUY+oVY+Y/uPZS1wxUD5dz+IHCAAtWzLrhciWmyUgxgoTG:kg8oYiYUY+oVY+Y/uhdUvySci9y3pTG
- TLSH
  T10B721A11B794C26AC19D0A714DB3D30043F1EE528513EBAFDCD8B07E6EBB69506613BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  LimeRAT v0.9.1/Misc/Plugins/DET.dll
- Size 25KB
- SHA256 b344ba0e6c05617ca4fe823f74b16020e504df45b700ba977a71427f55346f52
- MD5 0bad4116aadddd5b9e25ca18e9ab5bef
- SHA1 6cb5ad6364021218520ff727c6f740d70a64b0b0
- SHA512 eebb91c001286b53dd48f6baaa6df08579af1c48adf5545fbcb0ef5e0096197098d0221bd8d9d99a518b8783ade6c630d37740261bfe2d71098274db1ba7af7b
- SSDEEP 384:ggBFPQEoywzRwPzwWB1+ncLW396N2X9z87LcWJMAC4y+OcDNa36VN9fJllX15:ggBFPQEoB98UY4TNAJNZllF5
- TLSH
  T124C2192533A2C268D1FE1E785971978945B2AE135A21FA3E4CD930CA4F276D08F51AF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  LimeRAT v0.9.1/Misc/Plugins/ENC.dll
- Size 385KB
- SHA256 d23e4ae419e623a154fcf44e6cd1587968cd03500dd0a5d899f0c2e6578b5f8e
- MD5 e4378ef21768f1d46b1f20d6dd6f47b2
- SHA1 f0bfebbe85cf73dbb44c54e47335277db19995f5
- SHA512 f604a777d53c3a2c794ddf002af6545a876ec60929d9b06c5e831e097282ff838f58691e1bff019f126ff960d6bdb63ebb6908b6f1bf5a2a4dc90d3a32da062b
- SSDEEP 3072:QisSNTn/CWlyCZcxwycHQoZNdTGWfSsHxBHUZB7+eRFRi/I5dynXh9TVSzI+:QGxlzZZNdTGSUZceRFR6Qdynn
- TLSH
  T19E845190BF80F860E5661E3F7F3048DC91AF5C41472296C77A72E27919FD9F1A3860A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  LimeRAT v0.9.1/Misc/Plugins/FM.dll
- Size 17KB
- SHA256 5e6bf4d488f8833fae9ecfd3ac8aac985ae93190155934902d773ffc2c009fc1
- MD5 52964900b2357b51c5e3eef56646b68b
- SHA1 518077191a5adde403366d6036be924fb66d354a
- SHA512 99a59f88c7d699ecdbd42c3108caabc713162c8d25960ccf84069b82934da5e9b9948b57022a8f2de4cf035e501fa904612c6a90a06e9326d70d3de4bf8eb1f4
- SSDEEP 384:4gBimfb8owV4zMn/x0LGu5935swrxMc8/HtEEB07njuvuhmA:4gBimfwLteNb5sXc7juvcmA
- TLSH
  T1D48219017B95C227C5ED09724CB3A35047F6CB164622FB5E8CCCB0AA9B7F3641752AB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  LimeRAT v0.9.1/Misc/Plugins/IconLib.dll
- Size 59KB
- SHA256 087a0c5f789e964a2fbcb781015d3fc9d1757358bc63bb4e0b863b4dffdb6e4f
- MD5 45ecaf5e82da876240f9be946923406c
- SHA1 0e79bfe8ecc9b0a22430d1c13c423fbf0ac2a61d
- SHA512 6fd4a25051414b2d70569a82dff5522606bfc34d3eaeea54d2d924bc9c92e479c7fda178208026308a1bf9c90bee9dbcaf8716d85c2ab7f383b43b0734329bc8
- SSDEEP 768:WhZeVOIr9zmWGODfqED8zOJI+IpXgJKCAyEpd+rnwTIQJAqLiA4B0FdIOFMBC3Wd:EP1m3KpOKSEp1TzCaFiPBhlg36eiikN
- TLSH
  T18B535C18677CA322C56E0B7F64B92A4483B0A251A6B3FB0E4EE494B31D737C55B11B93
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  LimeRAT v0.9.1/Misc/Plugins/Interop.Shell32.dll
- Size 38KB
- SHA256 c06cf5cab6da4788f7ccb4ab5f4c3a637753f5d64899384a0c1cf8234fc55caa
- MD5 a69c07ef0f1cf17688ea8a3ce231f497
- SHA1 59504b2b4cd736e4c146e31fe2e69d2e4c522e11
- SHA512 d2ac42fad411d2934a9df83f5dc6f13b4c2c3f30517bc1ee97249c304eada1cdfdb0cc89fe0854130209ec94a0af6b928e123436b36485c79401f2ae783fa161
- SSDEEP 768:b0K4C/dcdDpQCZWNxYRokhwfsdgg4e9mC6Hj7tr+BckNU:b0K4C/kQrIwEgg4v
- TLSH
  T14503E562721C8264DD2E43F985B3DF9063B1E2111A62DF0A149DA32C1F6B1D9BD427BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  LimeRAT v0.9.1/Misc/Plugins/KLG.dll
- Size 15KB
- SHA256 30daeb60cfeac12179e8d3d130af2c47b349e371facf502cd495e57129902036
- MD5 5c62f8ddf5001db403406cad183b9b84
- SHA1 a24b3bd7e9d64e09f105f63c7d8d2002c571ece4
- SHA512 5c673a241d27d08f5cc92f1d1e3c263300751e44be9b5506712412a4ee414811de337bbe357059f399df7c0e780980c24064fe71613dc28a70384c88dc58da81
- SSDEEP 192:+g8TiJ+M2IQIMshN2XeYlph+xJXxnTaO9NyAGBG+o0/6IW12chbmKff+uOUtLpDq:+g6W+M2eSlpQFa4YA4a0Zcha5UttDW9
- TLSH
  T10E620B51A3E08332C4EE27B94C63938156B2D2509516FF7E9CCCE0965EBB7880B5167F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  LimeRAT v0.9.1/Misc/Plugins/LOC.dll
- Size 10KB
- SHA256 216a37065f76de764039533396c66d704e63cc41c15fff3f519867d96b35753c
- MD5 e03365b2d417047d4056eb66f715fcfd
- SHA1 e77da0ff98f244fbee52f2db1a87dc008820ffa6
- SHA512 385d2011885e076d054edc8b9f66ad08e36452a8aa832f5738160f839f2870f41105686bad7adf8dc656481ad158183c6a8fff8afe78ec240194c40a770cfc0c
- SSDEEP 192:ez5UPoyKau+ifowO58TVGOlmTz9Z8L6otIW1xZ2AcSjEhkWd:ezOpO658TQL9OL6oJZ2ujEeWd
- TLSH
  T11922F91793948233C9AF1F724CA3A2414AB1DF059A1FEB2F5CC491598D673490A63BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  LimeRAT v0.9.1/Misc/Plugins/LOCS.dll
- Size 8KB
- SHA256 24c50ebf6bfee3852e3b34680133cd03dc4c0fe89fa221510e981cd79bd44a71
- MD5 59f8598d509830dfb407f444b0865f8e
- SHA1 cbc5f0f1dde698b232dec78df0d5bf96279b065f
- SHA512 a68d4ad4bc0d6837c8e33eb27b4951478995a0a64765e398da6918d38c5832a59668a22998ac692020001e343720d5dba41dc00d4c106e62c4a17217232b578d
- SSDEEP 192:9tShigDDVm4icNziGOmF14qkIW1Pn/HmuAL/W0:9tSwgf5FzPb4qun/Gu6/W0
- TLSH
  T1C7F10B3253A0C3B6D9670F739C5766814A75E7108A6BEF3F988CD1234DA72550BE1B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15
- Target
  LimeRAT v0.9.1/Misc/Plugins/MISC.dll
- Size 13KB
- SHA256 9257054fe037bbfbc0f3bf5670b6dc2b3482c358ac2cbd6470950255095b030c
- MD5 0a6a1828f69c84c9a057d6a0dcc7fe5d
- SHA1 ce8ada1eeb27ff9bbcd07b106e4c7734ee198a30
- SHA512 0a46593293bc61f0f9b0777c5ddab0bdc91517f6200a6af5f01db647b758356c6ce4665167db151af8ac85d53bf403ad33b65dd9e0be39eef6d0652f38bef44b
- SSDEEP 384:fLNgmfE+eOKHBOSJQMoiJb/PJWnhO7RAm6bz/WUN:fLNg0RezHBOyowb3x7eb
- TLSH
  T1AC52191477E49279D9FE4B3318B2564102B2DF451633EF5E88E3B00A697338647A2AB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  LimeRAT v0.9.1/Misc/Plugins/Open.Nat.dll
- Size 62KB
- SHA256 f3c0613c158c5f52a6d62b342d7f1ecfa634ec1b93990275cfd31c59449240ea
- MD5 3bd414ab4bab80e63e1d36467bef267b
- SHA1 3bed596c86a3443cf719cbe2ee5f4317f03863af
- SHA512 c15c266aabfc0f88375d2cb0d1c2c6431a213075861d3d3811e4a3dfa6618add0f685fef024508628ac3e0ea75570bc7a3211964f40810cef827bdb69d2eb6cb
- SSDEEP 1536:bqsMcNMVbuFMcCFJsBP1R4tN/CF7RlR4OrK3:bqsMcNMVbiOuBP6CPlrU
- TLSH
  T110532B0833FD062ADAFE1F7968B501C90BB5F84A7022EB9D5D4498EB0DA27814E31777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  LimeRAT v0.9.1/Misc/Plugins/PCL.dll
- Size 11KB
- SHA256 79fd8de7fa23c805fa3601a0a059d62b094b2a31094f2aeae4ff05a79324461a
- MD5 e52e23ae154e4d7e9a8dfddb694b792e
- SHA1 47770db0ab80ac45bc48ec124cee69e5fdf27b45
- SHA512 1042f69d4a8334d647855275eea6dfb2ac3f3bb5af53b0987b6749fe543a208ef78659b06c175d7d4eeebca7dac20098bef27bcc960be2dcb5007df66acd082b
- SSDEEP 192:KgAzFHGmY9dghoOw2xEUOG99MYmdGOSINoL1pQdIW1DOQKT9HcsxW9:KggQmY9dghXwKEw9ix4zKoZpQ7OQI8QK
- TLSH
  T1DF320A1567D08276D99E0F730DA3578247B6DE015627EF2E44C8B12A5D733C40AE2B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18
- Target
  LimeRAT v0.9.1/Misc/Plugins/PERS.dll
- Size 29KB
- SHA256 0b80c59ed83278da073a4063496ff6c4a4b5380a6d3b3a6328d01c68c14816d6
- MD5 52afcab228231939c94efaa6ecc5170f
- SHA1 922f84dfef8c369b9d1d0673e3c76b2689af7842
- SHA512 ea0ee1cc9f82c519dbb7c57a68bbbb5f67979225551a51c613e46690f238b9a261a63c5d2df86976f53fff672d03bbdfeafdb699bf487183a46de05f5fb1f8d3
- SSDEEP 768:LjegQmaxaS7snjn5QNVsIzK/WAqyLvasBzPW:LjhQ57sjn8qIzK+Arv3zPW
- TLSH
  T1C7D20A259394C279DDAA0BB31CA357410BF2DB04852AFF3F58C9E1664DB339506A3B72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  LimeRAT v0.9.1/Misc/Plugins/PIN.dll
- Size 112KB
- SHA256 06bc310e81f979f77ab47ef45f35e47ae1d353441d1996253524532b59c1f925
- MD5 9c5f9c9089b3c70fbbc57da6f577f205
- SHA1 ab03a5ac41ea58860b960358a575742ee034b890
- SHA512 a51b5c9116e51164ed44a24d9b8aa96795080f773bdc238d4a6973efe36b0875fc9dcca2bd459ed31e653058d765a5e864cda1ed2ea38c98e21635627d310ecf
- SSDEEP 3072:1KMsMP1mcvSy3zkNNXx4tUPvt3pq451pOlxhGu:1B0ykNXGtUPvt3pq45vmxh
- TLSH
  T1BEB34B16736C9321C96D07BE58B76A4083B0E20156B3EF0A0DDCA36A0F673C95E527B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20
- Target
  LimeRAT v0.9.1/Misc/Plugins/PWD.dll
- Size 24KB
- SHA256 b411a6655773feb35c02d697e4276780140852d1663b9e81aaf23f0f3c334bde
- MD5 5a80c3e4aa479351d486ace1623720b6
- SHA1 f974956dd7fb94416ff8f60fc00612b9039d8a40
- SHA512 1429083d6537de8a2b9de6b7061c88fd7795a254151f8681b1e1e3f544d356cb46c3ae5aee6a0b7b34843c24f313f3479d955bb65ebf55868017320b6812767d
- SSDEEP 384:Fem/i4pVcUcU0hW/JO9kW6QkWyDdJivfe7nGRAuv4YP0GS/ATb88BE9B:FL/iuVcBW/JiyWGdlGRp+GYAWB
- TLSH
  T151B22A0173E9C3A1DDED0B76192D62428BBAD0A7E911FB6E6CC490D527D2BA00641FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21
- Target
  LimeRAT v0.9.1/Misc/Plugins/RDP.dll
- Size 17KB
- SHA256 0d7f0b5cb2ff3d776a0a728c2fe26a89e807f7ba3b8c8cc977cd56ee233207b7
- MD5 ae1c59131cc8c40670f651e0cc83c73f
- SHA1 80b949a2d5aef61d00943801b25988bf876636c6
- SHA512 e48708d88a5de46ed5d64490614cb39194b361fdd590f0c00c5648f316bf27417c94820ad6502dd2900ec531e3ca4a952c17b4f546ab0897227da28aae04fa9f
- SSDEEP 384:4g1pd6QwpbYLbGI/hfaZrhJ3SdFaLc8/BLUXaHUwQ:4g1pIQwp6bGI/hYlJ3djHUwQ
- TLSH
  T1648209586BD0C766D5FD2F792D63A60043F2D3945602FB6F8CC8B0E64E677801B91AB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22
- Target
  LimeRAT v0.9.1/Misc/Plugins/System.Threading.dll
- Size 378KB
- SHA256 8a791af9e3861e231662b657098a823b21a084cbb6a4901d6ccf363405849a78
- MD5 f5ee17938d7c545bf62ad955803661c7
- SHA1 dd0647d250539f1ec580737de102e2515558f422
- SHA512 669a89ad811cda4f3ff4aa318aa03e26e4cb41ea22bc321bad02a671273d867cbd223a64bb30da592a5484a9f1cec77c96f5bf63b1fe586b6d3688b8c9da530c
- SSDEEP 6144:mH4bNycoylcQQAzB0ebN+pM4CHavptCyO3mEQGS/eoO4:mYbNWQQAzB0e176veD3mPh/O4
- TLSH
  T116844901B3DCC323E7AF9A77F174586A4771D482964BE30A245DF6B42CD3B640E096BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  LimeRAT v0.9.1/Misc/Plugins/USB.dll
- Size 88KB
- SHA256 641f9a883ae652f24fa036e0b9690369e1ac582d5d865fb9c27c482c3123d243
- MD5 bd75da2a4c69ae560b8d35d3830e0994
- SHA1 00adb52f31569a5caa1f0bc1922761205eadd648
- SHA512 063d8278befaf7293c58f34fc87ef788638e1ebf1ff5a133e6c194dc74a5301c7709b9011dfa7df09f1479a9fe5df7722388115f94f8d9878b7c1a6b81541dcd
- SSDEEP 1536:w87UH4PmvgldWaae4KaFCRCP1m3KpOKSEp1TzCaFiPBhlg36eiikNX:w5H4Pmvgmaa/KmCEP1mcvSy3zkNX
- TLSH
  T18E932A146EE85635E6BF4A3DCBE53558A3B0B363A323DB7D1EB444960B233825AC0753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24
- Target
  LimeRAT v0.9.1/Misc/Plugins/WRDP.dll
- Size 1.8MB
- SHA256 224fec6be9db067c511cd68d4406d06a760bff8b56e96b7a3e7f8b6880b7bde7
- MD5 5de3fcad65e6f71a4b2bdcbe66cc4bc6
- SHA1 715a9cbd79bfc1858a82edc49bbeff6238197e31
- SHA512 b60f5c8b30ee49db25569a53f46a773caf2214b7e01551fb5dc5e85e637ff921d42ea4e4d84d0159cd166351d5e5fd89518147ca558ad102b6c5cef840e007b1
- SSDEEP 24576:0rKxoVT2iXc+IZ++6WiaTAsN/3ebTvK+63CWH8iA/iD2hgPjcC8SVdKumYr7+hV/:xHZ5pdqYH8ia6GcKuR7IzBh
- TLSH
  T1FD957C15F7EC4136D0AB82399AB56371C7BAB4841F20E3CF2164069A7F277E05E3539A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25
- Target
  LimeRAT v0.9.1/Misc/Plugins/XMR.dll
- Size 468KB
- SHA256 9a30776aa4253a1dd151201b91543a5f25e5a3dbf567150f75f30b5e10f1af7b
- MD5 a759896c967fc551a7aa77aac85c64b0
- SHA1 81b71412a481383a32516ecd412d60d42ab371cf
- SHA512 62baf3d05c9acfa0d4b44419f07461abe5d1df02c3f0ef6b9e187a52df2bfbbb175addcea4cf334218b20a33816ad8ec18e57335db058ed2dd8bdbb0fc6bdd15
- SSDEEP 6144:rAwsEY+IAtcpzpErggvRKQjPZr/8gziQPkqgf4GkNyZ5aLh1KK2+VL:rAwI+I5pzkKCL8sPzg/sK5aN1K5W
- TLSH
  T168A4232927C10564F7F7473D98A6BF12833631AA5A45EB12867A0FBF910E35A0F73C61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26
- Target
  LimeRAT v0.9.1/Misc/Stub/Stub.il
- Size 228KB
- SHA256 6e9b2760ce183fd48b53c29cc2f05ad57b942fe826981d9467595318ac101416
- MD5 5e00ac7dc0d18dfb466c3c8d3548a4d9
- SHA1 86c7a172bc732647f9fa6e582d8744aad9452ddb
- SHA512 4f0699fc8e4316654a1fe4964feaa308035366d2459666598580e80501634419b89088cd118ead71b690a95e3cc7453d6797ea827b910fdad5d102ec01de7c66
- SSDEEP 6144:6YaG0RRu0RRA37wyr3bktE/CMl9LJUPfj3Ze+8PGiQFt:6YaG0RRu0RRA37Xr3bktE/CMl9LJUPf7
- TLSH
  T11A34CD295328A5A9E873611DBA21CB55F36F52234E72AC827CDFC748FF32185437463A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27
- Target
  LimeRAT v0.9.1/Mono.Cecil.dll
- Size 330KB
- SHA256 80db0c28d53072acd056793a8258925ffae212c6433955758d31010b403cea0d
- MD5 3d4a4f72ff8281fb8624c062121e8cd0
- SHA1 8747c11210686a2277f6e1755e660e24258023da
- SHA512 6eb87f4c9b570aa4bfe83aa5a9c1281372ada124fc18429acdf2b1697cc5114e7242aad31f98984f305c0a536bb2d3f87ef9d884f777a93712810c223cc15e61
- SSDEEP 6144:t7cB4KCzaTUKlJyuYXTyyJr11oFu3vt3bUugoCoagUKR:tyzUKlcXunu3+ug1gU
- TLSH
  T1F0748D7567EC5A2BE68E83BBE095141683F5EC1A728FEF8E9D44A2FD4C037915900363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Family: LimeRAT

Checks computer location settings

Executes dropped EXE

Contacts third-party web service commonly abused for C2

Looks up external IP address via web service

Maps connected drives based on registry

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28