MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2ae769ea95c96424c00f5e008281fa39f1596be07f3f39776bbb814c0cafe97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LimeRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2ae769ea95c96424c00f5e008281fa39f1596be07f3f39776bbb814c0cafe97
SHA3-384 hash: df4f7f88b0ff1ad83e2950d9cf210307debf9f691604a9d3d16e6df491e0ee207aeb56619b16440fd0e62e263be5d440
SHA1 hash: be68ef44a456f2951333d665c9ff9de74391598f
MD5 hash: f4ad879259cae57145b5254c2d026bcf
humanhash: muppet-sierra-delta-alanine
File name:N-2045...pdf.gz
Download: download sample
Signature LimeRAT
Create hunting rule
File size:217'146 bytes
First seen:2020-08-18 11:24:32 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:z7//3NW0YvJQVRK0V3+7tk6/v1JppymHR:f/1W1xQVM0su6X2mx
TLSH 832423094D5A5BA72ACDF710406CEB5BDE0438B092EA6CEED6116C953FBB39C44893C7
Reporter abuse_ch
Tags:gz LimeRAT nVpn RAT


Avatar
abuse_ch
Malspam distributing LimeRAT:

HELO: mail.micgrup.com
Sending IP: 51.68.105.75
From: Facturacion <facturacion@stmseguridad.com>
Subject: purchase inquiry
Attachment: N-2045...pdf.gz (contains "Lime_masarati.exe")

LimeRAT C2:
194.5.97.59:51510

Hosted on nVpn:

% Information related to '194.5.97.0 - 194.5.97.255'

% Abuse contact for '194.5.97.0 - 194.5.97.255' is 'abuse@kgb-vpn.org'

inetnum: 194.5.97.0 - 194.5.97.255
netname: NET-NINAZU
remarks: ------------------------------------------
remarks: * This network is used for a VPN service.
remarks: * No logs are stored in any shape or form.
remarks: ------------------------------------------
country: EU
admin-c: NVS100-RIPE
tech-c: NVS100-RIPE
org: ORG-NVS2-RIPE
mnt-by: NINAZU-MNT
status: SUB-ALLOCATED PA
created: 2018-07-23T09:31:45Z
last-modified: 2020-08-02T13:13:48Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
889
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f2ae769ea95c96424c00f5e008281fa39f1596be07f3f39776bbb814c0cafe97/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 11:26:05 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6kxhnhvjlsleetaa6xqaqka7uoprlfv6a7z7hf3wxo4bjqgk72lq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f2ae769ea95c96424c00f5e008281fa39f1596be07f3f39776bbb814c0cafe97

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

LimeRAT

gz f2ae769ea95c96424c00f5e008281fa39f1596be07f3f39776bbb814c0cafe97

(this sample)

LimeRAT

Executable exe 258475fb4d0c7c39b4d702172b78d67fc9223792061729543c97d0950c396b5e

  
Dropping
MD5 5fea87d4e0afb8e31981bb6c1f9b1673
  
Dropping
LimeRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 258475fb4d0c7c39b4d702172b78d67fc9223792061729543c97d0950c396b5e

Comments