Summary:
The researcher has discovered common malware kind is now Remote Access Trojans its adaptability LimeRAT, a member of the RAT family that is known more than some of its competitors has drawn attention. It has the ability to engage in a number of harmful actions, such as data exfiltration, the development of DDoS botnets, and the facilitation of cryptocurrency mining. It is a stealthy threat due to its small footprint which enables it to evade detection by endpoint detection systems. It's interesting to note that LimeRAT resembles njRAT.[/subscribe_to_unlock_form]
Summary:
The researcher has discovered common malware kind is now Remote Access Trojans its adaptability LimeRAT, a member of the RAT family that is known more than some of its competitors has drawn attention. It has the ability to engage in a number of harmful actions, such as data exfiltration, the development of DDoS botnets, and the facilitation of cryptocurrency mining. It is a stealthy threat due to its small footprint which enables it to evade detection by endpoint detection systems. It's interesting to note that LimeRAT resembles njRAT.[emaillocker id="1283"]
A LimeRAT sample's configuration from an extracted sample. According to the sample's .NET code, the researchers used DnSpy to evaluate it. They identified the use of obfuscation techniques and found a class that resembled the malware configuration. This class contained a field with a base64-encoded encrypted string in it. They discovered the function that was in charge of decrypting the string by looking more at the code. They were able to duplicate the processes involved in decrypting LimeRAT's configuration which included creating instances of the RijndaelManaged and MD5CryptoServiceProvider classes, creating a 32-byte array comprising the AES key, and decrypting the string using the AES256-ECB technique. Decrypting the string revealed a link to a PasteBin note containing LimeRAT's Command and Control (C2) server. The brief overview of their LimeRAT configuration decryption process will be insightful to readers.
The Remote Access Trojans (RATs), with LimeRAT gaining observation for its ability in performing a variety of malicious activities while evading detection. A link to LimeRAT's command and control server was recently discovered after researchers examined a LimeRAT sample and decrypted its configuration.
Threat Profile:
References:
The following reports contain further technical details:
https://thehackernews.com/2023/04/limerat-malware-analysis-extracting.html
[/emaillocker]