MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c12ce1a73f6ab3029d1286de66751e079068e64bfc56f0652c8e19dd8c45e350. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LimeRAT

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	c12ce1a73f6ab3029d1286de66751e079068e64bfc56f0652c8e19dd8c45e350
SHA3-384 hash:	e8dd13999dc6483755ee8df36a99c74fa51dcd66ee1612fd70289141bcf4359825da779fc4739aa2e20a8614a58c0259
SHA1 hash:	8eaedfcedd5861f63243dc4d23df418fa3973137
MD5 hash:	c6d010d13e2f82f180b7f3cfdbd1dde0
humanhash:	freddie-texas-jig-burger
File name:	Invoice.xlsm
Download:	download sample
Signature	LimeRAT Create hunting rule
File size:	229'229 bytes
First seen:	2020-08-19 14:23:16 UTC
Last seen:	2020-08-19 14:45:30 UTC
File type:	xlsm
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep	6144:824sumCmhlOaOJtVyYq1zLmiSB9BS+uJnFPwB5dsDyk:8rsumCmTOa2tVB06Bj8++nFPE7k
TLSH	7D2412C890FD6CE2C92F8CA6E51C784B711DF98A0447C9EF47CA441AB16ADC14E9D52F
Reporter	abuse_ch
Tags:	LimeRAT RAT xlsm

abuse_ch

Malspam distributing LimeRAT:

HELO: box.officiialsupport.net
Sending IP: 134.209.80.221
From: Power and water corporation <services@officiialsupport.net>
Subject: Water bill
Attachment: Invoice.xlsm

LimeRAT payload URLs:
http://supofficemainlivedsributionsproceed.duckdns.org/bp.exe
https://pastebin.com/raw/P2Re0BdB

LimeRAT C2:
103.153.79.45:5959

Intelligence

File Origin

# of uploads :

# of downloads :

934

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Heur.Macro.Generic.h.b7a0bb3b.15401.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Creating a file

Sending a custom TCP request

Launching a process

Creating a process with a hidden window

Sending an HTTP GET request

Unauthorized injection to a recently created process by context flags manipulation

Creating a process from a recently created file

Result

Threat name:

Unknown

Detection:

malicious

Classification:

troj.expl

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/438466

Signature

Binary contains a suspicious time stamp

Connects to a pastebin service (likely for C&C)

Document exploit detected (creates forbidden files)

Document exploit detected (drops PE files)

Document exploit detected (process start blacklist hit)

Drops PE files to the user root directory

Machine Learning detection for dropped file

Machine Learning detection for sample

Office process drops PE file

Sigma detected: Executables Started in Suspicious Folder

Sigma detected: Execution in Non-Executable Folder

Sigma detected: MS Office Product Spawning Exe in User Dir

Sigma detected: Suspicious Program Location Process Starts

Uses dynamic DNS services

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c12ce1a73f6ab3029d1286de66751e079068e64bfc56f0652c8e19dd8c45e350/

Threat name:

Document-Word.Downloader.EncDoc

Status:

Malicious

First seen:

2020-08-19 05:06:03 UTC

AV detection:

15 of 29 (51.72%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yewodjz7nkzqfhisq3pgm5i6a6igrzsl7rlpazjmrym53dcf4nia._file

Result

Malware family:

limerat

Score:

10/10

Tags:

rat family:limerat

Link:

https://tria.ge/reports/200819-pdam948lm2/

Behaviour

Creates scheduled task(s)

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Office loads VBA resources, possible macro or embedded object present

Suspicious use of SetThreadContext

Legitimate hosting services abused for malware hosting/C2

Loads dropped DLL

Executes dropped EXE

LimeRAT

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Dropper

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/c12ce1a73f6ab3029d1286de66751e079068e64bfc56f0652c8e19dd8c45e350

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.