MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c69f392d73ffa5b09d2ea03cefd8e5e7d9a490ef819468db9409bd9988e26c54. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LimeRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c69f392d73ffa5b09d2ea03cefd8e5e7d9a490ef819468db9409bd9988e26c54
SHA3-384 hash: 6dded5a0d92f7f601d717ce33f1763b865e3ac58ff99257aa15f61e5e7c31a839fed3f2e88ad029a3ab716052961a91a
SHA1 hash: 66a30ea369d8b6c1c4e104a60c00f6b768d9a8fe
MD5 hash: fddbc5383fba3cf91507dc94f5270eae
humanhash: steak-bravo-one-venus
File name:fddbc5383fba3cf91507dc94f5270eae.exe
Download: download sample
Signature LimeRAT
Create hunting rule
File size:972'288 bytes
First seen:2021-06-22 18:03:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:rcdWFHmv9S/opsKyhz+/WUx2tMmlyVUBEc3uSG3QipP5J:rDHkSgpsKB/P81lxzip/
Threatray 559 similar samples on MalwareBazaar
TLSH 8B25BF220ECF422AE2754FB557B0BC87C3B66DB62605A2263DC031ADCA375D9CDEE511
Reporter abuse_ch
Tags:exe LimeRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
841
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
fddbc5383fba3cf91507dc94f5270eae.exe
Verdict:
Malicious activity
Analysis date:
2021-06-22 18:05:40 UTC
Tags:
trojan limerat rat
Link:
https://app.any.run/tasks/0f3ee38e-2e4c-4173-9350-e2abe9332a19

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/167659/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader39.59262.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
njRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/87decbc0-dd11-4d9f-8a7c-5de2f72fe214
Result
Threat name:
LimeRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/806183
Signature
.NET source code references suspicious native API functions
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Connects to a pastebin service (likely for C&C)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Protects its processes via BreakOnTermination flag
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected LimeRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c69f392d73ffa5b09d2ea03cefd8e5e7d9a490ef819468db9409bd9988e26c54/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-22 17:08:26 UTC
AV detection:
12 of 29 (41.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=y2ptsllt76s3bhjoua6o7whf47m2jehpqgkgrw4ubg6ztchcnrka._file
Verdict:
malicious
Similar samples:
10a30b9776bb8981976fe678e4538e68c8fbbb0a57f34934978b3df7238be8d5
LimeRAT
3dff78186451d97e6c3403b885ffb148cc7130b2b787b915041c7363feb74c68
LimeRAT
843097123a40e1442b2f08ce9c77ebc909a3e77e1ea3b6f21981a579ab2ea9be
LimeRAT
8a31c332dfb8714bc0c66300102fa84ee54a4027ed40e2c7082957abb431c34e
LimeRAT
8b9fd93906cbfe3753c41220bc9ad789d0cc7f279ccb223b7ced9e965a544c52
LimeRAT
95ee7873a8954c7d39d24608eddc2cdb4b2092a6ee6e2dd2d486046583172b6c
LimeRAT
a81addf8ad395ae36a617da9fb138337c17941475c1e3f3003d2571c8cb3b84e
LimeRAT
b4f0d107e95fa6f3aaae96d0341f0f0ad90b2dfa1fe7d9e04903eb2354a39ded
LimeRAT
b85e4c358cd20b0ad6e0bcdb93e578ee2dc2a898cfa60da1f39be1ea8424ce92
LimeRAT
efddb8625f7f35e91fad6672c67fe3c5073ba036d95e640de966fe68025afaff
LimeRAT
+ 549 additional samples on MalwareBazaar
Result
Malware family:
limerat
Create hunting rule
Score:
  10/10
Tags:
family:limerat rat
Link:
https://tria.ge/reports/210622-qpzgvwn6qe/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
LimeRAT
Unpacked files
SH256 hash:
71e791809684f88927d726e597f39681184fc7dc388ed1644ab4d3c0f77e6eaf
MD5 hash:
b1673529dfab8eac090d314ad40c9ccf
SHA1 hash:
c1975bdc7cb23fb1ac7307e4fc63b38ee1778bad
Link:
https://www.unpac.me/results/131bdf67-62fc-411b-a529-87c001c58347/
SH256 hash:
18a01cfee65098b0cdc7b92f49c87446aca438513dc1e83e3572ed690dbe9dac
MD5 hash:
93a1da3ed01bfa2ef4808d086a4d47a2
SHA1 hash:
35baa372c64d6f903ffeb77566d2db3bd43510bb
Link:
https://www.unpac.me/results/131bdf67-62fc-411b-a529-87c001c58347/
SH256 hash:
779096b4a3924776a2874f92419b3383cb9208e5634c8dafb25045b4dbd7b837
MD5 hash:
32b691102ffdd267c1d769abb0860427
SHA1 hash:
31e288efd6636d9b1fe8e96ad65d405de92a2c3b
Link:
https://www.unpac.me/results/131bdf67-62fc-411b-a529-87c001c58347/
SH256 hash:
c69f392d73ffa5b09d2ea03cefd8e5e7d9a490ef819468db9409bd9988e26c54
MD5 hash:
fddbc5383fba3cf91507dc94f5270eae
SHA1 hash:
66a30ea369d8b6c1c4e104a60c00f6b768d9a8fe
Link:
https://www.unpac.me/results/131bdf67-62fc-411b-a529-87c001c58347/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c69f392d73ffa5b09d2ea03cefd8e5e7d9a490ef819468db9409bd9988e26c54

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_LimeRAT
Create hunting rule
Author:ditekSHen
Description:LimeRAT payload
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LimeRAT

Executable exe c69f392d73ffa5b09d2ea03cefd8e5e7d9a490ef819468db9409bd9988e26c54

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1387578/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/167659/
  
URLhaus
https://urlhaus.abuse.ch/url/1390756/

Comments