RAT
LimeRAT
## Description Simple yet powerful RAT for Windows machines.
LimeRAT is a Windows rat operated by APT-C-36.
Background
LimeRAT is a compact but capable RAT for Windows, presented as a straightforward project meant to illustrate how dotNET malware is built and behaves. Coded in Visual Basic .NET (the client needs framework 2.0 or 4.0, the server 4.0), it pulls its ip:port from pastebin.com rather than noip.com DNS, supports multi-port operation, and uses a plugin system to keep the stub small and reduce AV detection, with AES protecting client-server communication. Its lightweight payload (around 25 KB) spreads by infecting all files and folders on USB drives, can uninstall itself on virtual machines to thwart analysis, and bundles a wide range of capabilities: ransomware that encrypts HDD and USB files with the .Lime extension, a high-performance Monero XMR CPU miner, DDoS attacks, cryptocurrency-data theft, a screen-locker, persistence, forced RDP enablement, a file manager, password and Bitcoin stealing, a downloader, and a keylogger.
Source: Malpedia (Fraunhofer FKIE).