MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cda57d12ed16414f52bfcfe2f3234d0fa5eb259aa20a59568cf040f6958047eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LimeRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 5 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cda57d12ed16414f52bfcfe2f3234d0fa5eb259aa20a59568cf040f6958047eb
SHA3-384 hash: b22c602cf0efe4531880c6c92b3848e88cb3f7e4fdfae130ff272678b2c389b1c8b9fe02e82577c49d660bf08da94a31
SHA1 hash: 7e41c5a900ad51626d37a3355d245eac826a1509
MD5 hash: b45c61350ecdc4abd20c7b0647de3e99
humanhash: west-gee-green-kitten
File name:b45c61350ecdc4abd20c7b0647de3e99
Download: download sample
Signature LimeRAT
Create hunting rule
File size:449'536 bytes
First seen:2021-10-18 15:13:37 UTC
Last seen:2021-10-18 16:15:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:sFSkF/Kuq5K1GRVNXjEuZFkLMk/lOF4E91cQoO4s:eSkFMo1CNzEusLMkdOFh9/oO
Threatray 660 similar samples on MalwareBazaar
TLSH T1AAA4933A6CE8127BB5779AB0DFF505C7BD1AB4933A41084EA49E03420A13F53BDE616D
Reporter zbetcheckin
Tags:32 exe LimeRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
842
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Spynet
Create hunting rule
Link:
https://www.capesandbox.com/analysis/198247/
Detection(s):
SecuriteInfo.com.Trojan.Encoder.34436.26421.31957.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a service
Creating a window
DNS request
Connection attempt
Sending a custom TCP request
Unauthorized injection to a recently created process
Launching a process
Creating a file in the %temp% directory
Delayed writing of the file
Blocking the Windows Defender launch
Adding exclusions to Windows Defender
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/616d8f41a9d585e6d52c1bac/reports/88339340-8971-43b2-95c7-792269da87fd/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
LimeRat
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1f5dc17a-dfd4-490b-bd5a-d9137b5930ef
Result
Threat name:
Cryptolocker LimeRAT
Create hunting rule
Detection:
malicious
Classification:
rans.troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/872407
Signature
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Connects to a pastebin service (likely for C&C)
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious names
Drops executables to the windows directory (C:\Windows) and starts them
Found Tor onion address
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Protects its processes via BreakOnTermination flag
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: Suspicious Svchost Process
Sigma detected: System File Execution Location Anomaly
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Cryptolocker ransomware
Yara detected LimeRAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 504831 Sample: F9PZRQUINW Startdate: 18/10/2021 Architecture: WINDOWS Score: 100 93 cdn.discordapp.com 2->93 113 Malicious sample detected (through community Yara rule) 2->113 115 Antivirus detection for dropped file 2->115 117 System process connects to network (likely due to code injection or exploit) 2->117 119 14 other signatures 2->119 10 F9PZRQUINW.exe 22 5 2->10         started        15 svhost.exe 2->15         started        17 svchost.exe 2->17         started        19 2 other processes 2->19 signatures3 process4 dnsIp5 101 cdn.discordapp.com 162.159.134.233, 443, 49752, 49758 CLOUDFLARENETUS United States 10->101 83 C:\Users\user\AppData\...\F9PZRQUINW.exe.log, ASCII 10->83 dropped 131 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 10->131 133 Uses schtasks.exe or at.exe to add and modify task schedules 10->133 135 Adds a directory exclusion to Windows Defender 10->135 21 F9PZRQUINW.exe 10->21         started        25 powershell.exe 24 10->25         started        27 powershell.exe 9 10->27         started        33 3 other processes 10->33 137 Multi AV Scanner detection for dropped file 15->137 29 WerFault.exe 15->29         started        31 WerFault.exe 17->31         started        file6 signatures7 process8 file9 81 C:\Users\user\AppData\Roaming\svhost.exe, PE32 21->81 dropped 125 Protects its processes via BreakOnTermination flag 21->125 127 Hides that the sample has been downloaded from the Internet (zone.identifier) 21->127 35 svhost.exe 21->35         started        39 schtasks.exe 21->39         started        41 conhost.exe 25->41         started        43 conhost.exe 27->43         started        129 Drops executables to the windows directory (C:\Windows) and starts them 31->129 45 conhost.exe 33->45         started        47 conhost.exe 33->47         started        signatures10 process11 dnsIp12 95 162.159.135.233, 443, 49771, 49772 CLOUDFLARENETUS United States 35->95 97 192.168.2.1 unknown unknown 35->97 99 cdn.discordapp.com 35->99 123 Adds a directory exclusion to Windows Defender 35->123 49 svhost.exe 35->49         started        54 powershell.exe 35->54         started        56 powershell.exe 35->56         started        60 3 other processes 35->60 58 conhost.exe 39->58         started        signatures13 process14 dnsIp15 89 pastebin.com 104.23.99.190, 443, 49777 CLOUDFLARENETUS United States 49->89 91 198.23.172.50, 3306, 49778 AS-COLOCROSSINGUS United States 49->91 75 C:\Users\user\AppData\Roaming\IconLib.dll, PE32 49->75 dropped 77 C:\Users\user\AppData\...\tmp8C61.tmp.exe, PE32 49->77 dropped 79 C:\Users\user\AppData\...\Interop.Shell32.dll, PE32 49->79 dropped 121 Protects its processes via BreakOnTermination flag 49->121 62 tmp8C61.tmp.exe 49->62         started        67 conhost.exe 54->67         started        69 conhost.exe 56->69         started        71 conhost.exe 60->71         started        73 conhost.exe 60->73         started        file16 signatures17 process18 dnsIp19 103 cdn.discordapp.com 62->103 85 C:\Windows\Cursors\...\svchost.exe, PE32 62->85 dropped 87 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 62->87 dropped 105 Multi AV Scanner detection for dropped file 62->105 107 Creates autostart registry keys with suspicious names 62->107 109 Creates an autostart registry key pointing to binary in C:\Windows 62->109 111 2 other signatures 62->111 file20 signatures21
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cda57d12ed16414f52bfcfe2f3234d0fa5eb259aa20a59568cf040f6958047eb/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-10-18 11:29:10 UTC
AV detection:
13 of 28 (46.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zwsx2exnczau6uv7z7rpgi2nb6s6wjm2uiffsvum6bapnfmai7vq._file
Verdict:
malicious
Similar samples:
2774da0c82b3700d74725edf23bef248083b6df616c7b494c05d4b5aec3ef2f2
LimeRAT
2ac91449fd255e02594e29de0f1c66c70fb0ba1af3dd87846ffe3e21503ffb4d
LimeRAT
32016cf36c5e99a6c8fba8fd4ffad8b5f301cac55439ae73fec5db799ac341ab
LimeRAT
519ba7ae267491633e2a01e55735586ba94829871e5c4ec2fe0a5c8fafe004b8
LimeRAT
63cc7593ecc74d78b39a46559da7124216bb5bc0e9eed2d7996717c462871ea6
LimeRAT
8f348bddd7f0130d5cb44993275cc8fa322b48e0a54ec61dc8449dd20d02fd75
LimeRAT
954988371d8cebea1a69f2c1a47d50b13b9eb82630e5fbc5069105bd12b7b541
LimeRAT
a397a5fde8ef63a32f7867346eebabd48d1ddf0a60c0d95abf431d9d2c51e017
LimeRAT
c7ce97bf28191b9f81871421f7f6fea0c86fca516d3e8706e16c0f07e9e7ed5b
LimeRAT
d89c68b81a492812f334c6485f8867419efb302da480f13d56ce1e9801c20096
LimeRAT
+ 650 additional samples on MalwareBazaar
Result
Malware family:
limerat
Create hunting rule
Score:
  10/10
Tags:
family:limerat evasion persistence ransomware rat trojan
Link:
https://tria.ge/reports/211018-smckaaegej/
Behaviour
Creates scheduled task(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Drops desktop.ini file(s)
Enumerates connected drives
Legitimate hosting services abused for malware hosting/C2
Loads dropped DLL
Uses the VBS compiler for execution
Windows security modification
Executes dropped EXE
Modifies Installed Components in the registry
Nirsoft
LimeRAT
Modifies Windows Defender Real-time Protection settings
Turns off Windows Defender SpyNet reporting
Windows security bypass
Unpacked files
SH256 hash:
cda57d12ed16414f52bfcfe2f3234d0fa5eb259aa20a59568cf040f6958047eb
MD5 hash:
b45c61350ecdc4abd20c7b0647de3e99
SHA1 hash:
7e41c5a900ad51626d37a3355d245eac826a1509
Link:
https://www.unpac.me/results/28671d54-de3c-4e0a-a9e2-a248acc91deb/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/cda57d12ed16/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/cda57d12ed16414f52bfcfe2f3234d0fa5eb259aa20a59568cf040f6958047eb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:quakbot_halo_generated
Create hunting rule
Author:Halogen Generated Rule, Corsin Camichel
Rule name:silentbuilder_halo_generated
Create hunting rule
Author:Halogen Generated Rule, Corsin Camichel
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LimeRAT

Executable exe cda57d12ed16414f52bfcfe2f3234d0fa5eb259aa20a59568cf040f6958047eb

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/198247/
  
URLhaus
https://urlhaus.abuse.ch/url/1691668/

Comments


Avatar
zbet commented on 2021-10-18 15:13:39 UTC

url : hxxp://sinopars.ir/wp-includes/js/new.exe