MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 75a158306a69245ccd3f2cafb279a56bdfb3dcc8fc88115547c737d0bf75603c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LimeRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 75a158306a69245ccd3f2cafb279a56bdfb3dcc8fc88115547c737d0bf75603c
SHA3-384 hash: 6459b85e641f45709ff54754827c05b33cb363a07e5482702292f9de19ab6e326d279b48001b3afeb7e82954ba58cfbd
SHA1 hash: f2231f673e80289e43e7e18f64566ebad7f83d3f
MD5 hash: 6cdcbc5d71ceb0b2436df16f19768226
humanhash: sink-lactose-fix-washington
File name:OfficialDoc.img
Download: download sample
Signature LimeRAT
Create hunting rule
File size:1'245'184 bytes
First seen:2020-12-03 08:35:56 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 3072:9/+xb7YFLLlBofoCkMiLnWhofonhdRop67bQc4VEec8oCWCrkTfg6gGircvOlBqe:9cbkidX4rTMCr
TLSH 084564D2B341449AF97706B1F4ABCC1410E76EBDA072611E29FB77A29AF3353205790B
Reporter abuse_ch
Tags:img LimeRAT RAT


Avatar
abuse_ch
Malspam distributing LimeRAT:

HELO: karvelis.serveriai.lt
Sending IP: 79.98.28.33
From: Amanda, British Airways <info@saimis.lt>
Reply-To: amandasalman0x@protonmail.com
Subject: Itinerary Confirmation
Attachment: OfficialDoc.img (contains "officialdoc!_013_2020.exe")

LimeRAT C2:
15.188.8.52:1177

Intelligence

File Origin
# of uploads :
1
# of downloads :
774
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.95.32689.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/75a158306a69245ccd3f2cafb279a56bdfb3dcc8fc88115547c737d0bf75603c/
Threat name:
ByteCode-MSIL.Infostealer.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-12-03 08:36:13 UTC
AV detection:
8 of 46 (17.39%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=owqvqmdknesfztj7fsx3e6nfnpp3hxgi7sebcvkhy435bp3vma6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/75a158306a69245ccd3f2cafb279a56bdfb3dcc8fc88115547c737d0bf75603c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

LimeRAT

img 75a158306a69245ccd3f2cafb279a56bdfb3dcc8fc88115547c737d0bf75603c

(this sample)

LimeRAT

Executable exe 78aa904a6d06db0ae3190ffdecda755b20e7c4dff3c8dd2061a7d35e7171d5ca

  
Dropping
MD5 084eecf7d4654a7e7f4a7c4e6044c967
  
Dropping
LimeRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 78aa904a6d06db0ae3190ffdecda755b20e7c4dff3c8dd2061a7d35e7171d5ca

Comments