Overview

overview

10

Static

static

11fef3ffa7...43.exe

windows7_x64

10

11fef3ffa7...43.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11fef3ffa74a3151c5af1b7b8eaad7ae248521e15521a8e5b0ed386f2ace8d43

  • Size

    756KB

  • Sample

    220603-2sfzbscacp

  • MD5

    4df228d57f566b60975c6bb6135bfc44

  • SHA1

    6c39efaafd4d52c473eaae7de32cbb976a5dcfe6

  • SHA256

    11fef3ffa74a3151c5af1b7b8eaad7ae248521e15521a8e5b0ed386f2ace8d43

  • SHA512

    b25c25d16e335e58c80d8794f70b64744bd6188730cc4b195aaa6e2113b4314253b91c8e39024cef0a4877f584b09dd57dee1cb56ce78b37a1492902645fd55d

Score
10/10
imminentspywaretrojan

Malware Config

Targets

    • Target

      11fef3ffa74a3151c5af1b7b8eaad7ae248521e15521a8e5b0ed386f2ace8d43

    • Size

      756KB

    • MD5

      4df228d57f566b60975c6bb6135bfc44

    • SHA1

      6c39efaafd4d52c473eaae7de32cbb976a5dcfe6

    • SHA256

      11fef3ffa74a3151c5af1b7b8eaad7ae248521e15521a8e5b0ed386f2ace8d43

    • SHA512

      b25c25d16e335e58c80d8794f70b64744bd6188730cc4b195aaa6e2113b4314253b91c8e39024cef0a4877f584b09dd57dee1cb56ce78b37a1492902645fd55d

    Score
    10/10
    imminentspywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks