LimeRAT v0.9.1.7z
- SHA256 c948b48bc12b31bcf63322793938fe0f633766cf28b7949ff4f6511f2ebf8256
Password
infected
Overview
overview
10Static
static
3LimeRAT v0...AT.exe
windows10-2004-x64
10LimeRAT v0...xe.xml
windows10-2004-x64
3LimeRAT v0...ts.dll
windows10-2004-x64
1LimeRAT v0...rk.dll
windows10-2004-x64
1LimeRAT v0...YP.dll
windows10-2004-x64
3LimeRAT v0...OS.dll
windows10-2004-x64
3LimeRAT v0...EC.dll
windows10-2004-x64
3LimeRAT v0...ET.dll
windows10-2004-x64
3LimeRAT v0...NC.dll
windows10-2004-x64
3LimeRAT v0...FM.dll
windows10-2004-x64
3LimeRAT v0...ib.dll
windows10-2004-x64
1LimeRAT v0...32.dll
windows10-2004-x64
3LimeRAT v0...LG.dll
windows10-2004-x64
3LimeRAT v0...OC.dll
windows10-2004-x64
3LimeRAT v0...CS.dll
windows10-2004-x64
3LimeRAT v0...SC.dll
windows10-2004-x64
1LimeRAT v0...at.dll
windows10-2004-x64
1LimeRAT v0...CL.dll
windows10-2004-x64
3LimeRAT v0...RS.dll
windows10-2004-x64
3LimeRAT v0...IN.dll
windows10-2004-x64
3LimeRAT v0...WD.dll
windows10-2004-x64
3LimeRAT v0...DP.dll
windows10-2004-x64
3LimeRAT v0...ng.dll
windows10-2004-x64
1LimeRAT v0...SB.dll
windows10-2004-x64
3LimeRAT v0...DP.dll
windows10-2004-x64
3LimeRAT v0...MR.dll
windows10-2004-x64
3LimeRAT v0...ub.ps1
windows10-2004-x64
3LimeRAT v0...il.dll
windows10-2004-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
LimeRAT v0.9.1/LimeRAT.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
25 signatures
300 seconds
Behavioral task
behavioral2
Sample
LimeRAT v0.9.1/LimeRAT.exe.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
300 seconds
Behavioral task
behavioral3
Sample
LimeRAT v0.9.1/MetroFramework.Fonts.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
LimeRAT v0.9.1/MetroFramework.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral5
Sample
LimeRAT v0.9.1/Misc/Plugins/CRYP.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral6
Sample
LimeRAT v0.9.1/Misc/Plugins/DDOS.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral7
Sample
LimeRAT v0.9.1/Misc/Plugins/DEC.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral8
Sample
LimeRAT v0.9.1/Misc/Plugins/DET.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral9
Sample
LimeRAT v0.9.1/Misc/Plugins/ENC.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral10
Sample
LimeRAT v0.9.1/Misc/Plugins/FM.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral11
Sample
LimeRAT v0.9.1/Misc/Plugins/IconLib.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral12
Sample
LimeRAT v0.9.1/Misc/Plugins/Interop.Shell32.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral13
Sample
LimeRAT v0.9.1/Misc/Plugins/KLG.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral14
Sample
LimeRAT v0.9.1/Misc/Plugins/LOC.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral15
Sample
LimeRAT v0.9.1/Misc/Plugins/LOCS.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral16
Sample
LimeRAT v0.9.1/Misc/Plugins/MISC.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
LimeRAT v0.9.1/Misc/Plugins/Open.Nat.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
LimeRAT v0.9.1/Misc/Plugins/PCL.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral19
Sample
LimeRAT v0.9.1/Misc/Plugins/PERS.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral20
Sample
LimeRAT v0.9.1/Misc/Plugins/PIN.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral21
Sample
LimeRAT v0.9.1/Misc/Plugins/PWD.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral22
Sample
LimeRAT v0.9.1/Misc/Plugins/RDP.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral23
Sample
LimeRAT v0.9.1/Misc/Plugins/System.Threading.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral24
Sample
LimeRAT v0.9.1/Misc/Plugins/USB.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral25
Sample
LimeRAT v0.9.1/Misc/Plugins/WRDP.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral26
Sample
LimeRAT v0.9.1/Misc/Plugins/XMR.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral27
Sample
LimeRAT v0.9.1/Misc/Stub/Stub.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral28
Sample
LimeRAT v0.9.1/Mono.Cecil.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
General
- Target LimeRAT v0.9.1.7z
- Size 3.2MB
- Sample261011-2vffksst2l
- SHA256 c948b48bc12b31bcf63322793938fe0f633766cf28b7949ff4f6511f2ebf8256
- MD5 07a87fde900cbf711336b7eddd6b5849
- SHA1 352147aa2c70005b7b7d39bbfba01c7b1f4656e1
- SHA512 d52a6828f1984318ea0526ac36aec6a53aebb34e2d0634c9db136c7f5d03620c0ff709a090d8b89e6f19f6c1c539cac04b2f8cd039307a7d79521d814e0d84b5
- SSDEEP 49152:aKf+2E4Fp1Ux+Fzk1g0pmoT1P7b/iga7LUfJRXrlWMUxtADrD6T3CMXFs:jm2E4FjUJVpza7LUTrlbUxtA/0Xm
- TLSH T162E533E9019CFBC3ACF5C16EA0E9CEF7A42957AFC53089DB063086B87352129913975D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 25 IoCs
Checks for missing Authenticode signature.
resource unpack001/LimeRAT v0.9.1/LimeRAT.exe unpack001/LimeRAT v0.9.1/MetroFramework.Fonts.dll unpack001/LimeRAT v0.9.1/MetroFramework.dll unpack001/LimeRAT v0.9.1/Misc/Plugins/CRYP.dll unpack001/LimeRAT v0.9.1/Misc/Plugins/DDOS.dll unpack001/LimeRAT v0.9.1/Misc/Plugins/DEC.dll unpack001/LimeRAT v0.9.1/Misc/Plugins/DET.dll unpack001/LimeRAT v0.9.1/Misc/Plugins/ENC.dll unpack001/LimeRAT v0.9.1/Misc/Plugins/FM.dll unpack001/LimeRAT v0.9.1/Misc/Plugins/IconLib.dll unpack001/LimeRAT v0.9.1/Misc/Plugins/Interop.Shell32.dll unpack001/LimeRAT v0.9.1/Misc/Plugins/KLG.dll unpack001/LimeRAT v0.9.1/Misc/Plugins/LOC.dll unpack001/LimeRAT v0.9.1/Misc/Plugins/LOCS.dll unpack001/LimeRAT v0.9.1/Misc/Plugins/MISC.dll unpack001/LimeRAT v0.9.1/Misc/Plugins/Open.Nat.dll unpack001/LimeRAT v0.9.1/Misc/Plugins/PCL.dll unpack001/LimeRAT v0.9.1/Misc/Plugins/PERS.dll unpack001/LimeRAT v0.9.1/Misc/Plugins/PIN.dll unpack001/LimeRAT v0.9.1/Misc/Plugins/PWD.dll unpack001/LimeRAT v0.9.1/Misc/Plugins/RDP.dll unpack001/LimeRAT v0.9.1/Misc/Plugins/USB.dll unpack001/LimeRAT v0.9.1/Misc/Plugins/WRDP.dll unpack001/LimeRAT v0.9.1/Misc/Plugins/XMR.dll unpack001/LimeRAT v0.9.1/Mono.Cecil.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/LimeRAT v0.9.1/Misc/Plugins/System.Threading.dll
File Explorer
-
LimeRAT v0.9.1.7z.7z 3.2MB
-
LimeRAT v0.9.1/LimeRAT.exe.exe 7.1MB
-
LimeRAT v0.9.1/LimeRAT.exe.config.xml 4KB
-
LimeRAT v0.9.1/MetroFramework.Fonts.dll.dll 656KB
-
LimeRAT v0.9.1/MetroFramework.dll.dll 149KB
-
LimeRAT v0.9.1/Misc/Plugins/CRYP.dll.dll 15KB
-
LimeRAT v0.9.1/Misc/Plugins/DDOS.dll.dll 15KB
-
LimeRAT v0.9.1/Misc/Plugins/DEC.dll.dll 17KB
-
LimeRAT v0.9.1/Misc/Plugins/DET.dll.dll 25KB
-
LimeRAT v0.9.1/Misc/Plugins/ENC.dll.dll 385KB
-
LimeRAT v0.9.1/Misc/Plugins/FM.dll.dll 17KB
-
LimeRAT v0.9.1/Misc/Plugins/IconLib.dll.dll 59KB
-
LimeRAT v0.9.1/Misc/Plugins/Interop.Shell32.dll.dll 38KB
-
LimeRAT v0.9.1/Misc/Plugins/KLG.dll.dll 15KB
-
LimeRAT v0.9.1/Misc/Plugins/LOC.dll.dll 10KB
-
LimeRAT v0.9.1/Misc/Plugins/LOCS.dll.dll 8KB
-
LimeRAT v0.9.1/Misc/Plugins/MISC.dll.dll 13KB
-
LimeRAT v0.9.1/Misc/Plugins/Open.Nat.dll.dll 62KB
-
LimeRAT v0.9.1/Misc/Plugins/PCL.dll.dll 11KB
-
LimeRAT v0.9.1/Misc/Plugins/PERS.dll.dll 29KB
-
LimeRAT v0.9.1/Misc/Plugins/PIN.dll.dll 112KB
-
LimeRAT v0.9.1/Misc/Plugins/PWD.dll.dll 24KB
-
LimeRAT v0.9.1/Misc/Plugins/RDP.dll.dll 17KB
-
LimeRAT v0.9.1/Misc/Plugins/System.Threading.dll.dll 378KB
-
LimeRAT v0.9.1/Misc/Plugins/USB.dll.dll 88KB
-
LimeRAT v0.9.1/Misc/Plugins/WRDP.dll.dll 1.8MB
-
LimeRAT v0.9.1/Misc/Plugins/XMR.dll.dll 468KB
-
LimeRAT v0.9.1/Misc/Stub/Stub.il.ps1 228KB
-
LimeRAT v0.9.1/Mono.Cecil.dll.dll 330KB
LimeRAT v0.9.1/LimeRAT.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 21f28da818acb238b9d08d7c746aa5cee2ca028e7b935ada65945ba20bde64a4
- MD5 0f7c026aa7fd009773c99a35d242ae05
- SHA1 2854eb57a1fb7062a43fece33f924d6b24ba1425
- SHA512 2483a8a7c53504bf1b2a87d50f1860f6b2700d3b46db42f418196b987bc378c2be833018f105ea70f3523d0d0bd053883256c421e573afbb673b9b48c6161124
- SSDEEP 98304:+feKeTLa67dos6bI0LO6rAXeb+N99rPmpVzY+QubLmok3VH:+fe/TB7Z0/wL99rPm1QubLmoU5
- TLSH T15D76D452BF40E851C4343ABF3E204EC8526B7D989F2652F33141B77D29F89F1AA982D5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
cv
Minor OS version
0
Major OS version
4
Entry point
7125994
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
6.8MB
Virtual Size
6.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
306KB
Virtual Size
306KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LimeRAT v0.9.1/LimeRAT.exe.config
- SHA256 c9bd2e2628a9fb7dcafbb0f30430a74eb003fb1c19ebc5bcbcff7e072c4dc0ea
- MD5 64f28b753cffe63facd13529b222bdb8
- SHA1 1996851dc1a619d81a7e80af8d053190856b58eb
- SHA512 6362c250a96e7a9b343246fdf619f7911082360a59ad98a5d93c6c1ea7d4002b3cc01575f135a029604009e8a5f0ba51f751520d0da4a6ad3e5e293a6142d7bb
- SSDEEP 48:cnkr7H1W7Hq8SsiYc4qNglvU7mTgrbHAdsu1MpxHHA0iHANHAifHA0HAioB5pqxv:Xr787KTYBhs79rjAiLAFAlAkAEA8Zsa
- TLSH T110913B48B5F5DEAA01476632AA3056859EF006771279B0F8B8FC71945F50CCA8BA33B8
- MD5 SHA1 SHA512 SSDEEP TLSH
LimeRAT v0.9.1/MetroFramework.Fonts.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e96030fddaf7e78401567ee82480ad75ee48d3556199a3f85c0ec669edac2ef4
- MD5 612080028164b12939751dcccbb68d4a
- SHA1 db066593c63d2eff41a5af1b49a3e098b60e0013
- SHA512 1879c960e27e32941c0c992b84803e7a1f8d243bfc88d17d3d32baca772290b9ea60a6ea90d53170be3bf7f0a58fe71ec901dc66aa560b4bf68b1da56c09fe18
- SSDEEP 12288:H+/9JcJlYqCNktA+SXfGpq2fHowSqCNktA+SXfvJR9FrIJJaqCNktA+SXfUC:H+/3qlrCNoh+UqgIwhCNoh+JR9FrIJJw
- TLSH T1BDE429B5760139E6EF11C4B7C260FD80192B7863A77B802A68E3077A88575CDFE53E46
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
cv
Minor OS version
0
Major OS version
4
Entry point
677630
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\home\dvlp\ManagedXLL-branches-4_0\MetroFramework\MetroFramework.Fonts\obj\Release\MetroFramework.Fonts.pdb
mscoree
_CorDllMain
Name
.text
Size
654KB
Virtual Size
653KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LimeRAT v0.9.1/MetroFramework.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 baf326f52d39155d722465947f4cc67e6e90cfd0f89954eab959568e9bc342aa
- MD5 44538b311e9ec2bcf0a6452702628d99
- SHA1 da67301539903775708e9ec913654851e9e8eade
- SHA512 b65e3bc1c0f7b4c8f778cf52a36d628301d60aab53fdaf0355163e4865bc3d3adbf8870bb6cefc604708fdf2c0e72258eaf2fe301d524af2f77bc08014c9610a
- SSDEEP 3072:LU0T+erz8jYxYg5lzrPHlMUzxXd4kRZPI9q:vT+erz8jYxYgv/lxXGWPS
- TLSH T139E33B21770D457FC6BF4A7AF0A12492C3B0DC51FA7BDF5D5C82A29C989B794AE01283
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
cv
Minor OS version
0
Major OS version
4
Entry point
157918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
146KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LimeRAT v0.9.1/Misc/Plugins/CRYP.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e890f6d0b08bdf34afa3fbe679964b751942a7468cbed79643e12412d3a0d90e
- MD5 fae6c90a20a01e807074b63e7442a9e7
- SHA1 c14872717d08235b4ff9d4815992f1ebb51f495c
- SHA512 61ab5f48db5b306f3eca71d945d29e5101b7299b9b73230a5b656fd2a1c886aab4f49cd0d20c15461abbca2865c4cde5a9f156cfca5b56588560e821c85be526
- SSDEEP 384:jUSg5rnE64MvptUIH1HmDhpQHmczLZ0sGBp/Wk:jUSg5rnE64M/UIVHm+p0sG
- TLSH T193620A60B3D4433BC2ED0A754D72A16147B1E74D9922FF6E9CC8A0CA0AA36594780FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
cv
Minor OS version
0
Major OS version
4
Entry point
21922
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\NC\source\repos\Lime-RAT\Project\Plugins\CRYP\obj\Release\CRYP.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LimeRAT v0.9.1/Misc/Plugins/DDOS.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7bf43f897a21eea2940868d922938e77a981aad99b71e2bdfeaf46df1d7795b0
- MD5 aecbe15ad47267028248ba2764f2664b
- SHA1 069fb977388e711aece591f6f3b8aca0388d45ab
- SHA512 5c32f29da9102b480879aa294abecb863c5cdd3608adff99631b088c95f05aa9df6bc879e32d8c0e6a66ee9f59bf9d6719bfeca5c70c2971fc6c9bee34a39e5e
- SSDEEP 384:q81guin6gszYCxUWFKP6lIpQa2UqhZQQxS9K2Nkz/WE:q81groYpyXQQcHNkL
- TLSH T18B62E7057BE08233CAFD0BB50DA353114B72EB078936FB6D049C605A8A77F819972B76
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
cv
Minor OS version
0
Major OS version
4
Entry point
21206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\NC\source\repos\Lime-RAT\Project\Plugins\DDOS\obj\Release\DDOS.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LimeRAT v0.9.1/Misc/Plugins/DEC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8fe52bdb56a7f279d39fdd0d2f31d78226ef8dcedfa0895c8738934cca8e7007
- MD5 724472f8f2f9a0ef4161afc18d756c51
- SHA1 dbc26a8d535527181a851b4ab979b26ada2b4f4a
- SHA512 8e98d6620a6996be7b248822b3bb264bf72f74c340250ae68b21080af70f7da14e2d2b636fcdd8f5e8628b2649a774189ffa9e64a04bc8f22f2ba921476cd72d
- SSDEEP 384:kg8Y/DYiYUY+oVY+Y/uPZS1wxUD5dz+IHCAAtWzLrhciWmyUgxgoTG:kg8oYiYUY+oVY+Y/uhdUvySci9y3pTG
- TLSH T10B721A11B794C26AC19D0A714DB3D30043F1EE528513EBAFDCD8B07E6EBB69506613BA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
cv
Minor OS version
0
Major OS version
4
Entry point
23070
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\NC\source\repos\Lime-RAT\Project\Plugins\DEC\obj\Release\DEC.pdb
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LimeRAT v0.9.1/Misc/Plugins/DET.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b344ba0e6c05617ca4fe823f74b16020e504df45b700ba977a71427f55346f52
- MD5 0bad4116aadddd5b9e25ca18e9ab5bef
- SHA1 6cb5ad6364021218520ff727c6f740d70a64b0b0
- SHA512 eebb91c001286b53dd48f6baaa6df08579af1c48adf5545fbcb0ef5e0096197098d0221bd8d9d99a518b8783ade6c630d37740261bfe2d71098274db1ba7af7b
- SSDEEP 384:ggBFPQEoywzRwPzwWB1+ncLW396N2X9z87LcWJMAC4y+OcDNa36VN9fJllX15:ggBFPQEoB98UY4TNAJNZllF5
- TLSH T124C2192533A2C268D1FE1E785971978945B2AE135A21FA3E4CD930CA4F276D08F51AF2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
cv
Minor OS version
0
Major OS version
4
Entry point
32070
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\NC\source\repos\Lime-RAT\Project\Plugins\DET\obj\Release\DET.pdb
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LimeRAT v0.9.1/Misc/Plugins/ENC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d23e4ae419e623a154fcf44e6cd1587968cd03500dd0a5d899f0c2e6578b5f8e
- MD5 e4378ef21768f1d46b1f20d6dd6f47b2
- SHA1 f0bfebbe85cf73dbb44c54e47335277db19995f5
- SHA512 f604a777d53c3a2c794ddf002af6545a876ec60929d9b06c5e831e097282ff838f58691e1bff019f126ff960d6bdb63ebb6908b6f1bf5a2a4dc90d3a32da062b
- SSDEEP 3072:QisSNTn/CWlyCZcxwycHQoZNdTGWfSsHxBHUZB7+eRFRi/I5dynXh9TVSzI+:QGxlzZZNdTGSUZceRFR6Qdynn
- TLSH T19E845190BF80F860E5661E3F7F3048DC91AF5C41472296C77A72E27919FD9F1A3860A9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
cv
Minor OS version
0
Major OS version
4
Entry point
399934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\NC\source\repos\Lime-RAT\Project\Plugins\ENC\obj\Release\ENC.pdb
mscoree
_CorDllMain
Name
.text
Size
383KB
Virtual Size
382KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LimeRAT v0.9.1/Misc/Plugins/FM.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5e6bf4d488f8833fae9ecfd3ac8aac985ae93190155934902d773ffc2c009fc1
- MD5 52964900b2357b51c5e3eef56646b68b
- SHA1 518077191a5adde403366d6036be924fb66d354a
- SHA512 99a59f88c7d699ecdbd42c3108caabc713162c8d25960ccf84069b82934da5e9b9948b57022a8f2de4cf035e501fa904612c6a90a06e9326d70d3de4bf8eb1f4
- SSDEEP 384:4gBimfb8owV4zMn/x0LGu5935swrxMc8/HtEEB07njuvuhmA:4gBimfwLteNb5sXc7juvcmA
- TLSH T1D48219017B95C227C5ED09724CB3A35047F6CB164622FB5E8CCCB0AA9B7F3641752AB6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23734
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\NC\source\repos\Lime-RAT\Project\Plugins\FM\obj\Release\FM.pdb
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LimeRAT v0.9.1/Misc/Plugins/IconLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 087a0c5f789e964a2fbcb781015d3fc9d1757358bc63bb4e0b863b4dffdb6e4f
- MD5 45ecaf5e82da876240f9be946923406c
- SHA1 0e79bfe8ecc9b0a22430d1c13c423fbf0ac2a61d
- SHA512 6fd4a25051414b2d70569a82dff5522606bfc34d3eaeea54d2d924bc9c92e479c7fda178208026308a1bf9c90bee9dbcaf8716d85c2ab7f383b43b0734329bc8
- SSDEEP 768:WhZeVOIr9zmWGODfqED8zOJI+IpXgJKCAyEpd+rnwTIQJAqLiA4B0FdIOFMBC3Wd:EP1m3KpOKSEp1TzCaFiPBhlg36eiikN
- TLSH T18B535C18677CA322C56E0B7F64B92A4483B0A251A6B3FB0E4EE494B31D737C55B11B93
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
67470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\Users\N A P O L E O N\Desktop\IconLib\obj\Debug\IconLib.pdb
mscoree
_CorDllMain
Name
.text
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LimeRAT v0.9.1/Misc/Plugins/Interop.Shell32.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c06cf5cab6da4788f7ccb4ab5f4c3a637753f5d64899384a0c1cf8234fc55caa
- MD5 a69c07ef0f1cf17688ea8a3ce231f497
- SHA1 59504b2b4cd736e4c146e31fe2e69d2e4c522e11
- SHA512 d2ac42fad411d2934a9df83f5dc6f13b4c2c3f30517bc1ee97249c304eada1cdfdb0cc89fe0854130209ec94a0af6b928e123436b36485c79401f2ae783fa161
- SSDEEP 768:b0K4C/dcdDpQCZWNxYRokhwfsdgg4e9mC6Hj7tr+BckNU:b0K4C/kQrIwEgg4v
- TLSH T14503E562721C8264DD2E43F985B3DF9063B1E2111A62DF0A149DA32C1F6B1D9BD427BF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
44878
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
776B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LimeRAT v0.9.1/Misc/Plugins/KLG.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 30daeb60cfeac12179e8d3d130af2c47b349e371facf502cd495e57129902036
- MD5 5c62f8ddf5001db403406cad183b9b84
- SHA1 a24b3bd7e9d64e09f105f63c7d8d2002c571ece4
- SHA512 5c673a241d27d08f5cc92f1d1e3c263300751e44be9b5506712412a4ee414811de337bbe357059f399df7c0e780980c24064fe71613dc28a70384c88dc58da81
- SSDEEP 192:+g8TiJ+M2IQIMshN2XeYlph+xJXxnTaO9NyAGBG+o0/6IW12chbmKff+uOUtLpDq:+g6W+M2eSlpQFa4YA4a0Zcha5UttDW9
- TLSH T10E620B51A3E08332C4EE27B94C63938156B2D2509516FF7E9CCCE0965EBB7880B5167F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21422
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\NC\source\repos\Lime-RAT\Project\Plugins\KLG\obj\Release\KLG.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LimeRAT v0.9.1/Misc/Plugins/LOC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 216a37065f76de764039533396c66d704e63cc41c15fff3f519867d96b35753c
- MD5 e03365b2d417047d4056eb66f715fcfd
- SHA1 e77da0ff98f244fbee52f2db1a87dc008820ffa6
- SHA512 385d2011885e076d054edc8b9f66ad08e36452a8aa832f5738160f839f2870f41105686bad7adf8dc656481ad158183c6a8fff8afe78ec240194c40a770cfc0c
- SSDEEP 192:ez5UPoyKau+ifowO58TVGOlmTz9Z8L6otIW1xZ2AcSjEhkWd:ezOpO658TQL9OL6oJZ2ujEeWd
- TLSH T11922F91793948233C9AF1F724CA3A2414AB1DF059A1FEB2F5CC491598D673490A63BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16622
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\NC\source\repos\Lime-RAT\Project\Plugins\LOC\obj\Release\LOC.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LimeRAT v0.9.1/Misc/Plugins/LOCS.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 24c50ebf6bfee3852e3b34680133cd03dc4c0fe89fa221510e981cd79bd44a71
- MD5 59f8598d509830dfb407f444b0865f8e
- SHA1 cbc5f0f1dde698b232dec78df0d5bf96279b065f
- SHA512 a68d4ad4bc0d6837c8e33eb27b4951478995a0a64765e398da6918d38c5832a59668a22998ac692020001e343720d5dba41dc00d4c106e62c4a17217232b578d
- SSDEEP 192:9tShigDDVm4icNziGOmF14qkIW1Pn/HmuAL/W0:9tSwgf5FzPb4qun/Gu6/W0
- TLSH T1C7F10B3253A0C3B6D9670F739C5766814A75E7108A6BEF3F988CD1234DA72550BE1B32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14314
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\NC\source\repos\Lime-RAT\Project\Plugins\LOCS\obj\Release\LOCS.pdb
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LimeRAT v0.9.1/Misc/Plugins/MISC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9257054fe037bbfbc0f3bf5670b6dc2b3482c358ac2cbd6470950255095b030c
- MD5 0a6a1828f69c84c9a057d6a0dcc7fe5d
- SHA1 ce8ada1eeb27ff9bbcd07b106e4c7734ee198a30
- SHA512 0a46593293bc61f0f9b0777c5ddab0bdc91517f6200a6af5f01db647b758356c6ce4665167db151af8ac85d53bf403ad33b65dd9e0be39eef6d0652f38bef44b
- SSDEEP 384:fLNgmfE+eOKHBOSJQMoiJb/PJWnhO7RAm6bz/WUN:fLNg0RezHBOyowb3x7eb
- TLSH T1AC52191477E49279D9FE4B3318B2564102B2DF451633EF5E88E3B00A697338647A2AB6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\NC\source\repos\Lime-RAT\Project\Plugins\MISC\obj\Release\MISC.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LimeRAT v0.9.1/Misc/Plugins/Open.Nat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f3c0613c158c5f52a6d62b342d7f1ecfa634ec1b93990275cfd31c59449240ea
- MD5 3bd414ab4bab80e63e1d36467bef267b
- SHA1 3bed596c86a3443cf719cbe2ee5f4317f03863af
- SHA512 c15c266aabfc0f88375d2cb0d1c2c6431a213075861d3d3811e4a3dfa6618add0f685fef024508628ac3e0ea75570bc7a3211964f40810cef827bdb69d2eb6cb
- SSDEEP 1536:bqsMcNMVbuFMcCFJsBP1R4tN/CF7RlR4OrK3:bqsMcNMVbiOuBP6CPlrU
- TLSH T110532B0833FD062ADAFE1F7968B501C90BB5F84A7022EB9D5D4498EB0DA27814E31777
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LimeRAT v0.9.1/Misc/Plugins/PCL.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 79fd8de7fa23c805fa3601a0a059d62b094b2a31094f2aeae4ff05a79324461a
- MD5 e52e23ae154e4d7e9a8dfddb694b792e
- SHA1 47770db0ab80ac45bc48ec124cee69e5fdf27b45
- SHA512 1042f69d4a8334d647855275eea6dfb2ac3f3bb5af53b0987b6749fe543a208ef78659b06c175d7d4eeebca7dac20098bef27bcc960be2dcb5007df66acd082b
- SSDEEP 192:KgAzFHGmY9dghoOw2xEUOG99MYmdGOSINoL1pQdIW1DOQKT9HcsxW9:KggQmY9dghXwKEw9ix4zKoZpQ7OQI8QK
- TLSH T1DF320A1567D08276D99E0F730DA3578247B6DE015627EF2E44C8B12A5D733C40AE2B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17386
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\NC\source\repos\Lime-RAT\Project\Plugins\PCL\obj\Release\PCL.pdb
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LimeRAT v0.9.1/Misc/Plugins/PERS.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0b80c59ed83278da073a4063496ff6c4a4b5380a6d3b3a6328d01c68c14816d6
- MD5 52afcab228231939c94efaa6ecc5170f
- SHA1 922f84dfef8c369b9d1d0673e3c76b2689af7842
- SHA512 ea0ee1cc9f82c519dbb7c57a68bbbb5f67979225551a51c613e46690f238b9a261a63c5d2df86976f53fff672d03bbdfeafdb699bf487183a46de05f5fb1f8d3
- SSDEEP 768:LjegQmaxaS7snjn5QNVsIzK/WAqyLvasBzPW:LjhQ57sjn8qIzK+Arv3zPW
- TLSH T1C7D20A259394C279DDAA0BB31CA357410BF2DB04852AFF3F58C9E1664DB339506A3B72
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
35406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LimeRAT v0.9.1/Misc/Plugins/PIN.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 06bc310e81f979f77ab47ef45f35e47ae1d353441d1996253524532b59c1f925
- MD5 9c5f9c9089b3c70fbbc57da6f577f205
- SHA1 ab03a5ac41ea58860b960358a575742ee034b890
- SHA512 a51b5c9116e51164ed44a24d9b8aa96795080f773bdc238d4a6973efe36b0875fc9dcca2bd459ed31e653058d765a5e864cda1ed2ea38c98e21635627d310ecf
- SSDEEP 3072:1KMsMP1mcvSy3zkNNXx4tUPvt3pq451pOlxhGu:1B0ykNXGtUPvt3pq45vmxh
- TLSH T1BEB34B16736C9321C96D07BE58B76A4083B0E20156B3EF0A0DDCA36A0F673C95E527B7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
120774
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\NC\source\repos\Lime-RAT\Project\Plugins\PIN\obj\Release\PIN.pdb
mscoree
_CorDllMain
Name
.text
Size
110KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LimeRAT v0.9.1/Misc/Plugins/PWD.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b411a6655773feb35c02d697e4276780140852d1663b9e81aaf23f0f3c334bde
- MD5 5a80c3e4aa479351d486ace1623720b6
- SHA1 f974956dd7fb94416ff8f60fc00612b9039d8a40
- SHA512 1429083d6537de8a2b9de6b7061c88fd7795a254151f8681b1e1e3f544d356cb46c3ae5aee6a0b7b34843c24f313f3479d955bb65ebf55868017320b6812767d
- SSDEEP 384:Fem/i4pVcUcU0hW/JO9kW6QkWyDdJivfe7nGRAuv4YP0GS/ATb88BE9B:FL/iuVcBW/JiyWGdlGRp+GYAWB
- TLSH T151B22A0173E9C3A1DDED0B76192D62428BBAD0A7E911FB6E6CC490D527D2BA00641FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31082
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\NC\source\repos\Lime-RAT\Project\Plugins\PWD\obj\Release\PWD.pdb
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LimeRAT v0.9.1/Misc/Plugins/RDP.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0d7f0b5cb2ff3d776a0a728c2fe26a89e807f7ba3b8c8cc977cd56ee233207b7
- MD5 ae1c59131cc8c40670f651e0cc83c73f
- SHA1 80b949a2d5aef61d00943801b25988bf876636c6
- SHA512 e48708d88a5de46ed5d64490614cb39194b361fdd590f0c00c5648f316bf27417c94820ad6502dd2900ec531e3ca4a952c17b4f546ab0897227da28aae04fa9f
- SSDEEP 384:4g1pd6QwpbYLbGI/hfaZrhJ3SdFaLc8/BLUXaHUwQ:4g1pIQwp6bGI/hYlJ3djHUwQ
- TLSH T1648209586BD0C766D5FD2F792D63A60043F2D3945602FB6F8CC8B0E64E677801B91AB2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23778
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\NC\source\repos\Lime-RAT\Project\Plugins\RDP\obj\Release\RDP.pdb
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LimeRAT v0.9.1/Misc/Plugins/System.Threading.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8a791af9e3861e231662b657098a823b21a084cbb6a4901d6ccf363405849a78
- MD5 f5ee17938d7c545bf62ad955803661c7
- SHA1 dd0647d250539f1ec580737de102e2515558f422
- SHA512 669a89ad811cda4f3ff4aa318aa03e26e4cb41ea22bc321bad02a671273d867cbd223a64bb30da592a5484a9f1cec77c96f5bf63b1fe586b6d3688b8c9da530c
- SSDEEP 6144:mH4bNycoylcQQAzB0ebN+pM4CHavptCyO3mEQGS/eoO4:mYbNWQQAzB0e176veD3mPh/O4
- TLSH T116844901B3DCC323E7AF9A77F174586A4771D482964BE30A245DF6B42CD3B640E096BA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
a6:e9:10:6c:8a:b6:b5:78:02:56:c2:cf:c8:c4:e9:27:bb:ec:f4:fc
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 9, 2011
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:08:77:5f:00:00:00:00:00:4a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 19, 2010 - Oct 19, 2011
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:04:b3:f5:00:00:00:00:00:0d
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2008 - Jul 25, 2011
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:15:08:27:00:00:00:00:00:0c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 25, 2006 - Jan 25, 2017
Minor OS version
0
Major OS version
4
Entry point
386126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\cp\main\built\Release\Temp\86167f787584e42c25873494b6be9c\System.Threading.pdb
mscoree
_CorDllMain
Name
.text
Size
369KB
Virtual Size
369KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LimeRAT v0.9.1/Misc/Plugins/USB.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 641f9a883ae652f24fa036e0b9690369e1ac582d5d865fb9c27c482c3123d243
- MD5 bd75da2a4c69ae560b8d35d3830e0994
- SHA1 00adb52f31569a5caa1f0bc1922761205eadd648
- SHA512 063d8278befaf7293c58f34fc87ef788638e1ebf1ff5a133e6c194dc74a5301c7709b9011dfa7df09f1479a9fe5df7722388115f94f8d9878b7c1a6b81541dcd
- SSDEEP 1536:w87UH4PmvgldWaae4KaFCRCP1m3KpOKSEp1TzCaFiPBhlg36eiikNX:w5H4Pmvgmaa/KmCEP1mcvSy3zkNX
- TLSH T18E932A146EE85635E6BF4A3DCBE53558A3B0B363A323DB7D1EB444960B233825AC0753
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
96202
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\NC\source\repos\Lime-RAT\Project\Plugins\USB\obj\Release\USB.pdb
mscoree
_CorDllMain
Name
.text
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LimeRAT v0.9.1/Misc/Plugins/WRDP.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 224fec6be9db067c511cd68d4406d06a760bff8b56e96b7a3e7f8b6880b7bde7
- MD5 5de3fcad65e6f71a4b2bdcbe66cc4bc6
- SHA1 715a9cbd79bfc1858a82edc49bbeff6238197e31
- SHA512 b60f5c8b30ee49db25569a53f46a773caf2214b7e01551fb5dc5e85e637ff921d42ea4e4d84d0159cd166351d5e5fd89518147ca558ad102b6c5cef840e007b1
- SSDEEP 24576:0rKxoVT2iXc+IZ++6WiaTAsN/3ebTvK+63CWH8iA/iD2hgPjcC8SVdKumYr7+hV/:xHZ5pdqYH8ia6GcKuR7IzBh
- TLSH T1FD957C15F7EC4136D0AB82399AB56371C7BAB4841F20E3CF2164069A7F277E05E3539A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1933722
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LimeRAT v0.9.1/Misc/Plugins/XMR.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9a30776aa4253a1dd151201b91543a5f25e5a3dbf567150f75f30b5e10f1af7b
- MD5 a759896c967fc551a7aa77aac85c64b0
- SHA1 81b71412a481383a32516ecd412d60d42ab371cf
- SHA512 62baf3d05c9acfa0d4b44419f07461abe5d1df02c3f0ef6b9e187a52df2bfbbb175addcea4cf334218b20a33816ad8ec18e57335db058ed2dd8bdbb0fc6bdd15
- SSDEEP 6144:rAwsEY+IAtcpzpErggvRKQjPZr/8gziQPkqgf4GkNyZ5aLh1KK2+VL:rAwI+I5pzkKCL8sPzg/sK5aN1K5W
- TLSH T168A4232927C10564F7F7473D98A6BF12833631AA5A45EB12867A0FBF910E35A0F73C61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
485346
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\NC\source\repos\Lime-RAT\Project\Plugins\XMR\obj\Release\XMR.pdb
mscoree
_CorDllMain
Name
.text
Size
466KB
Virtual Size
465KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LimeRAT v0.9.1/Misc/Stub/Stub.il
- SHA256 6e9b2760ce183fd48b53c29cc2f05ad57b942fe826981d9467595318ac101416
- MD5 5e00ac7dc0d18dfb466c3c8d3548a4d9
- SHA1 86c7a172bc732647f9fa6e582d8744aad9452ddb
- SHA512 4f0699fc8e4316654a1fe4964feaa308035366d2459666598580e80501634419b89088cd118ead71b690a95e3cc7453d6797ea827b910fdad5d102ec01de7c66
- SSDEEP 6144:6YaG0RRu0RRA37wyr3bktE/CMl9LJUPfj3Ze+8PGiQFt:6YaG0RRu0RRA37Xr3bktE/CMl9LJUPf7
- TLSH T11A34CD295328A5A9E873611DBA21CB55F36F52234E72AC827CDFC748FF32185437463A
- MD5 SHA1 SHA512 SSDEEP TLSH
LimeRAT v0.9.1/Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 80db0c28d53072acd056793a8258925ffae212c6433955758d31010b403cea0d
- MD5 3d4a4f72ff8281fb8624c062121e8cd0
- SHA1 8747c11210686a2277f6e1755e660e24258023da
- SHA512 6eb87f4c9b570aa4bfe83aa5a9c1281372ada124fc18429acdf2b1697cc5114e7242aad31f98984f305c0a536bb2d3f87ef9d884f777a93712810c223cc15e61
- SSDEEP 6144:t7cB4KCzaTUKlJyuYXTyyJr11oFu3vt3bUugoCoagUKR:tyzUKlcXunu3+ug1gU
- TLSH T1F0748D7567EC5A2BE68E83BBE095141683F5EC1A728FEF8E9D44A2FD4C037915900363
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
341998
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\sources\cecil\obj\net_4_0_Release\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
328KB
Virtual Size
328KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ