MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e658159df74c5e24e1548f5304b1bc881f7986bf43fb687c07e8f5fb531108d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LimeRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4e658159df74c5e24e1548f5304b1bc881f7986bf43fb687c07e8f5fb531108d
SHA3-384 hash: ba9310d922aab48c52fd52a375fffac03b7b41960eb7a636504b191c0e97d7828296703e817d0aeba31a99c49e3cfd89
SHA1 hash: c55f53523e99d7582365c923fe7dba52338155e5
MD5 hash: b48fbc4f8c0f1e01f596e9d336145f99
humanhash: magazine-foxtrot-magazine-lemon
File name:Copia di Pagamento Banco_BPM_Pdf.exe
Download: download sample
Signature LimeRAT
Create hunting rule
File size:24'064 bytes
First seen:2021-10-04 09:26:12 UTC
Last seen:2021-10-04 13:34:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 384:rx6Bt2X3mgI+Z6ApYAVLK624DJd/SidRssDFmEH/:r1lpY4LK6JZSidGsxmEf
Threatray 10'726 similar samples on MalwareBazaar
TLSH T1A3B2F7D2EA9841B8D87A6E3294738E73057F6F7ADA69B44C109DF2377F332824052E15
File icon (PE):PE icon
dhash icon 071a18b3939b67d3 (22 x AgentTesla, 12 x Formbook, 3 x RemcosRAT)
Reporter abuse_ch
Tags:exe geo ITA LimeRAT

Intelligence

File Origin
# of uploads :
3
# of downloads :
782
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Copia di Pagamento Banco_BPM_Pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-10-04 09:26:37 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/71e1be44-4165-4228-9823-e1d60f9579d9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/194514/
Detection(s):
SecuriteInfo.com.UDS.Trojan-PSW.MSIL.Agensla.gen.30790.31232.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a service
Creating a window
Connection attempt to an infection source
Sending a TCP request to an infection source
Launching a process
Creating a file in the %temp% directory
Delayed writing of the file
Query of malicious DNS domain
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/615c0f2198a6280f39324d0f/reports/8ebb357e-2524-4a2d-81eb-822552ea2f5f/overview
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/04be4588-7e64-4081-848c-b54d91e92bc1
Result
Threat name:
AgentTesla LimeRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/863768
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Connects to a pastebin service (likely for C&C)
Creates an undocumented autostart registry key
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Protects its processes via BreakOnTermination flag
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected LimeRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 496193 Sample: Copia di Pagamento Banco_BP... Startdate: 04/10/2021 Architecture: WINDOWS Score: 100 45 pastebin.com 2->45 53 Found malware configuration 2->53 55 Antivirus detection for dropped file 2->55 57 Yara detected AgentTesla 2->57 59 12 other signatures 2->59 10 Copia di Pagamento Banco_BPM_Pdf.exe 18 12 2->10         started        15 575756.exe 1 2->15         started        signatures3 process4 dnsIp5 47 store2.gofile.io 31.14.69.10, 443, 49752 LINKER-ASFR Virgin Islands (BRITISH) 10->47 37 C:\...\Igqvlotohwezkqvlime raw file_ok.exe, PE32 10->37 dropped 39 C:\...\Copia di Pagamento Banco_BPM_Pdf.exe, PE32 10->39 dropped 41 C:\Users\user\AppData\Local\...\Wahpjbqwp.vbs, ASCII 10->41 dropped 43 2 other files (1 malicious) 10->43 dropped 65 Creates an undocumented autostart registry key 10->65 67 Writes to foreign memory regions 10->67 69 Allocates memory in foreign processes 10->69 71 Injects a PE file into a foreign processes 10->71 17 wscript.exe 1 10->17         started        19 Copia di Pagamento Banco_BPM_Pdf.exe 2 10->19         started        21 conhost.exe 10->21         started        73 Antivirus detection for dropped file 15->73 75 Machine Learning detection for dropped file 15->75 77 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 15->77 file6 signatures7 process8 process9 23 Igqvlotohwezkqvlime raw file_ok.exe 4 17->23         started        file10 35 C:\Users\user\AppData\Local\...\575756.exe, PE32 23->35 dropped 61 Protects its processes via BreakOnTermination flag 23->61 63 Hides that the sample has been downloaded from the Internet (zone.identifier) 23->63 27 575756.exe 17 3 23->27         started        31 schtasks.exe 1 23->31         started        signatures11 process12 dnsIp13 49 79.134.225.22, 49807, 49809, 49811 FINK-TELECOM-SERVICESCH Switzerland 27->49 51 pastebin.com 104.23.98.190, 443, 49806, 49808 CLOUDFLARENETUS United States 27->51 79 Protects its processes via BreakOnTermination flag 27->79 33 conhost.exe 31->33         started        signatures14 process15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4e658159df74c5e24e1548f5304b1bc881f7986bf43fb687c07e8f5fb531108d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-10-04 09:27:10 UTC
AV detection:
3 of 45 (6.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jzsycwo7otc6etqvjd2tasy3zca7pgdl6q73nb6ap2hv7njrccgq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
33479e621225b6713bfe13e84fe5f2a3f1071f32cc2410b2a34681c744896a71
LimeRAT
49f7415f7b85e989eed8d42e320c82ea6f69850650672ea6d7df65332a7e48c6
LimeRAT
725e476d1d0194ad4b55aef56539c888c7be4d4224cef2438ec5744e230723f7
LimeRAT
7c7323889466fa08d4a797ccdc8403e10953dae98d1f413bf39d82d7d9f89e5d
LimeRAT
8065f0a8fb9f149f281c0bb9988547651d0a6c9350352cfd4b2013c65be5ccd2
LimeRAT
8586940b285a92802ff9ca77ab7fb949de2a24784d4724dc18ce6d9c1ad6f187
LimeRAT
e484dd89ca41783addc420ae8b28e965997644a1bd7a9af1485dc239f21e2ac6
LimeRAT
e56b6b0e8c952292ec51717b619e4570126aed99c7faca77a734dfad09a0a800
LimeRAT
+ 10'716 additional samples on MalwareBazaar
Result
Malware family:
limerat
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:limerat keylogger rat spyware stealer trojan
Link:
https://tria.ge/reports/211004-leq95sgag2/
Behaviour
Creates scheduled task(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Maps connected drives based on registry
Executes dropped EXE
AgentTesla Payload
AgentTesla
LimeRAT
Unpacked files
SH256 hash:
4e658159df74c5e24e1548f5304b1bc881f7986bf43fb687c07e8f5fb531108d
MD5 hash:
b48fbc4f8c0f1e01f596e9d336145f99
SHA1 hash:
c55f53523e99d7582365c923fe7dba52338155e5
Link:
https://www.unpac.me/results/f2a85f2a-0f4e-429d-92c0-b54be8cbb362/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/4e658159df74/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/4e658159df74c5e24e1548f5304b1bc881f7986bf43fb687c07e8f5fb531108d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/194514/

Comments