LimeRAT | Threat Level: medium | Type: RAT
Cryptographic Identifiers
| SHA256 | 93a09a5ecefc75e6fda23d83deffeffddf544da2103a75422e768d26cfe9ee7f |
|---|---|
| MD5 | e3eaf28d0259c1b26429966c9b09a3cc |
| File Type | exe |
| Size | 30.0 KB |
| First Seen | 2024-05-10 |
| File Name | 93a09a5ecefc75e6fda23d83deffeffddf544da2103a75422e768d26cfe9ee7f |
| Tags | exe, LimeRAT |
Malware Family: LimeRAT
LimeRAT, çok işlevli açık kaynak RAT'tır.
| Type | RAT |
|---|---|
| Programming Language | C#/.NET |
| Target Platform | Windows |
| C2 Protocol | TCP |
| Purpose | Açık kaynak RAT |
| First Seen Year | 2019 |
Threat Indicators (IOC)
- SHA256:
93a09a5ecefc75e6fda23d83deffeffddf544da2103a75422e768d26cfe9ee7f - MD5:
e3eaf28d0259c1b26429966c9b09a3cc
System Cleanup Guide
- Disconnect the system from the network — unplug ethernet, disable Wi-Fi
- Terminate suspicious processes from Task Manager
- Run a full system scan with Malwarebytes or Kaspersky
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run kayıtlarını kontrol edin
- Review newly created tasks in Task Scheduler
- Change all your account passwords from a clean device
- Gerekirse Windows'u yeniden yükleyin ve verilerinizi temiz bir yedeğe geri alın
YARA Rule Hints
rule LimeRAT_SHA256 {
meta:
description = "LimeRAT sample: 93a09a5ecefc75e6"
threat_level = "medium"
first_seen = "2024-05-10"
condition:
hash.sha256(0, filesize) == "93a09a5ecefc75e6fda23d83deffeffddf544da2103a75422e768d26cfe9ee7f"
}
LimeRAT — Malware Profile
LimeRAT Hindistan Kalyan Matka piyango temasiyla dağıtılan. kalyanonlinematkaapp.in.net C2. Disk Enum VM tespiti. AES crypto.
Malware Type
RAT
Programming Language
C#/.NET
C2 Protocol
TCP
Target Systems
Windows
Technical Details
C# .NET, AES sifreleme, TCP, Plugin tabanlı: RAT + Miner + Ransomware + Stealer, Clipboard Bitcoin hijacker, Monero madenci dahili, UAC bypass, Anti-analysis
Capabilities & Behavior
Uzaktan Erişim & Kontrol
Keylogger
Ekran Görüntüsü
Webcam Erişimi
Dosya Yönetimi
Süreç Yönetimi
Komut Yürütme
Kalıcılık Mekanizması
IOC List (2 indicators)
IOC — LimeRAT
# SHA256
93a09a5ecefc75e6fda23d83deffeffddf544da2103a75422e768d26cfe9ee7f
# MD5
e3eaf28d0259c1b26429966c9b09a3cc
| Type | Value | Note |
|---|---|---|
| sha256 | 93a09a5ecefc75e6fda23d83deffeffddf544da2103a75422e768d26cfe9ee7f | |
| md5 | e3eaf28d0259c1b26429966c9b09a3cc |
C2 Servers (5 recorded servers for this family)
| Address | Type | Port | Protocol | Status | Country |
|---|---|---|---|---|---|
| kalyanonlinematkaapp.in.net | domain | 443 | HTTPS | active | — |
| kalyanonlinematkaapp.in.net | domain | 443 | HTTPS | active | — |
| hu88999.com | domain | 443 | HTTPS | inactive | — |
| 45.90.222.109 | ip | 1177 | TCP | inactive | DE |
| 88.198.47.34 | ip | 4444 | TCP | inactive | DE |
C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.