MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fbeb3c0a58a2c563efca4582c381501cf5e17d22c2ac7c135ac32051a5013a63. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LimeRAT


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fbeb3c0a58a2c563efca4582c381501cf5e17d22c2ac7c135ac32051a5013a63
SHA3-384 hash: e07d4fa100345dbe500c0f9c75f525731ac6f5d0126b76d837c67ab38d21be1df6a54cb5189b3b8011694985be5090db
SHA1 hash: ae2121bdee585383517d2768420c730f08d44fe3
MD5 hash: a9aa5668a508b4e472ee51e9d563516a
humanhash: lion-vermont-florida-beryllium
File name:a9aa5668a508b4e472ee51e9d563516a.exe
Download: download sample
Signature LimeRAT
Create hunting rule
File size:73'728 bytes
First seen:2022-01-23 07:41:10 UTC
Last seen:2022-01-23 09:43:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 1536:DmMS39P9gIK9EHJ0cYeWQzPhOvVihneW9+f:DmMS39P9DK9i0wz5OdRSI
Threatray 332 similar samples on MalwareBazaar
TLSH T1EF739E3A27E4C5E5D75AA5F2E083F31013665EA2E742851E37A43BCE2C733858EED481
File icon (PE):PE icon
dhash icon 71f0c08888c0e070 (9 x SnakeKeylogger, 9 x AgentTesla, 8 x AsyncRAT)
Reporter abuse_ch
Tags:exe LimeRAT RAT


Avatar
abuse_ch
LimeRAT C2:
206.123.140.95:15600

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
206.123.140.95:15600 https://threatfox.abuse.ch/ioc/315292/

Intelligence

File Origin
# of uploads :
2
# of downloads :
717
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
anca.doc
Verdict:
Malicious activity
Analysis date:
2022-01-20 18:50:06 UTC
Tags:
macros macros-on-open
Link:
https://app.any.run/tasks/7a4a4372-9484-47b9-9573-f5792e4f0f4e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
LimeRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/221703/
Detection(s):
SecuriteInfo.com.W32.MSIL_Kryptik.GKG.genEldorado.9522.30935.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
DNS request
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/61ed06ccd32385db63206d66/reports/9d2dd3a4-2b50-4e33-be04-9d9a57dfcc12/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b94c59cb-ae13-431f-b91e-41d446de95c9
Result
Threat name:
LimeRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/925791
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Encrypted powershell cmdline option found
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Protects its processes via BreakOnTermination flag
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Sigma detected: Suspicius Add Task From User AppData Temp
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses ping.exe to check the status of other devices and networks
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected LimeRAT
Yara detected MSILDownloaderGeneric
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 558269 Sample: 9mpAQsWojh.exe Startdate: 23/01/2022 Architecture: WINDOWS Score: 100 60 yahoo.com 2->60 62 cdn.discordapp.com 2->62 94 Found malware configuration 2->94 96 Icon mismatch, binary includes an icon from a different legit application in order to fool users 2->96 98 Multi AV Scanner detection for submitted file 2->98 100 9 other signatures 2->100 10 9mpAQsWojh.exe 15 4 2->10         started        15 Syservices.exe 1 2->15         started        signatures3 process4 dnsIp5 64 cdn.discordapp.com 162.159.134.233, 443, 49745 CLOUDFLARENETUS United States 10->64 58 C:\Users\user\AppData\...\9mpAQsWojh.exe.log, ASCII 10->58 dropped 104 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 10->104 106 Encrypted powershell cmdline option found 10->106 108 Uses schtasks.exe or at.exe to add and modify task schedules 10->108 110 Injects a PE file into a foreign processes 10->110 17 9mpAQsWojh.exe 2 10->17         started        21 powershell.exe 9 10->21         started        112 Multi AV Scanner detection for dropped file 15->112 114 Machine Learning detection for dropped file 15->114 23 powershell.exe 15->23         started        file6 signatures7 process8 file9 56 C:\Users\user\AppData\...\Syservices.exe, PE32 17->56 dropped 88 Protects its processes via BreakOnTermination flag 17->88 90 Hides that the sample has been downloaded from the Internet (zone.identifier) 17->90 25 Syservices.exe 1 17->25         started        28 schtasks.exe 1 17->28         started        92 Uses ping.exe to check the status of other devices and networks 21->92 30 PING.EXE 1 21->30         started        33 PING.EXE 1 21->33         started        35 PING.EXE 1 21->35         started        41 3 other processes 21->41 37 PING.EXE 23->37         started        39 conhost.exe 23->39         started        signatures10 process11 dnsIp12 102 Encrypted powershell cmdline option found 25->102 43 powershell.exe 25->43         started        45 conhost.exe 28->45         started        66 yahoo.com 74.6.231.20 YAHOO-NE1US United States 30->66 68 74.6.143.26 YAHOO-3US United States 33->68 70 192.168.2.1 unknown unknown 33->70 72 98.137.11.163 YAHOO-GQ1US United States 35->72 74 74.6.231.21 YAHOO-NE1US United States 41->74 signatures13 process14 process15 47 PING.EXE 43->47         started        50 PING.EXE 43->50         started        52 PING.EXE 43->52         started        54 3 other processes 43->54 dnsIp16 76 98.137.11.164 YAHOO-GQ1US United States 47->76 78 yahoo.com 47->78 80 yahoo.com 50->80 82 yahoo.com 52->82 84 yahoo.com 54->84 86 yahoo.com 54->86
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fbeb3c0a58a2c563efca4582c381501cf5e17d22c2ac7c135ac32051a5013a63/
Threat name:
ByteCode-MSIL.Downloader.PsDownload
Create hunting rule
Status:
Malicious
First seen:
2022-01-21 19:28:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
24 of 43 (55.81%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7pvtycsyulcwh36kiwbmhakqdt26c7jcykwhye22ymqfdjibhjrq._file
Verdict:
malicious
Similar samples:
85d81b6f9a9ec97701b96279ed76f478e6c528fa999c2c62afa883afd35146e5
LimeRAT
904f29d18a2e624fdff3e46eb8aeef598c74304e9f763d26dcf4fc946812f9e5
LimeRAT
bbe645c9580d37f74350e17d80b68b6fa73fbeaee7c574320ff758d9c3cb7552
LimeRAT
d9d9a78770bcd89cf5a0875a3c099bd2be2f6460878aa6db722f3fcd2319f322
LimeRAT
dd5e879363900f6fb165bc02d131c844183d8b2061ed473a5f33b5984a7cb206
LimeRAT
f861b22de2dce92e689b895e8b862fe51bfab56cf466db8d1ea7513682cd3c36
LimeRAT
fa070ad21750a69c17bd104ae6fac4b05d12fe9d689101a38553619519f7edfb
LimeRAT
+ 322 additional samples on MalwareBazaar
Result
Malware family:
limerat
Create hunting rule
Score:
  10/10
Tags:
family:limerat rat
Link:
https://tria.ge/reports/220123-jjnzgafdgp/
Behaviour
Creates scheduled task(s)
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Loads dropped DLL
Executes dropped EXE
LimeRAT
Unpacked files
SH256 hash:
fbeb3c0a58a2c563efca4582c381501cf5e17d22c2ac7c135ac32051a5013a63
MD5 hash:
a9aa5668a508b4e472ee51e9d563516a
SHA1 hash:
ae2121bdee585383517d2768420c730f08d44fe3
Link:
https://www.unpac.me/results/cd842b8e-a56f-4d04-9e4b-5343d5f6314c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fbeb3c0a58a2c563efca4582c381501cf5e17d22c2ac7c135ac32051a5013a63

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_DiscordURL
Create hunting rule
Author:ditekSHen
Description:Detects executables Discord URL observed in first stage droppers
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_PE_Discord_Attachment_Oct21_1
Create hunting rule
Author:Florian Roth
Description:Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/221703/

Comments