Overview

overview

10

Static

static

0aff91c316...b9.exe

windows7_x64

10

0aff91c316...b9.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9

  • Size

    321KB

  • Sample

    220530-fy43fsadcj

  • MD5

    0d32cf9f79dc145a823d56d7964829e0

  • SHA1

    d487f0256c01dd8e5d950a6b0adf1c54e36fd934

  • SHA256

    0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9

  • SHA512

    8474e550702efa4d671cca9ce2c6367ab32369b1ead5dd2d08d8ef8389277b034d23e97f4bf6baa8af898784285d47ef0e58ea1ae59b33dc05c9f218c1d51553

Score
10/10
imminentpersistencespywaretrojan

Malware Config

Targets

    • Target

      0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9

    • Size

      321KB

    • MD5

      0d32cf9f79dc145a823d56d7964829e0

    • SHA1

      d487f0256c01dd8e5d950a6b0adf1c54e36fd934

    • SHA256

      0aff91c316bb8ad560ef89125bc7ed5de42e78348b829f8a1c14259a6daa48b9

    • SHA512

      8474e550702efa4d671cca9ce2c6367ab32369b1ead5dd2d08d8ef8389277b034d23e97f4bf6baa8af898784285d47ef0e58ea1ae59b33dc05c9f218c1d51553

    Score
    10/10
    imminentpersistencespywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks