Overview

overview

10

Static

static

97416074ff...59.exe

windows7_x64

10

97416074ff...59.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    97416074ffe0332f72ec0c2535fabf316b0cf51afd851db086fd1e3bb970d359

  • Size

    725KB

  • Sample

    220609-qf3f1sgdbj

  • MD5

    b5887fc368cc6c6f490b4a8a4d8cc469

  • SHA1

    8092ea17acfe4e885c3317bdbd98d95fd31c6de9

  • SHA256

    97416074ffe0332f72ec0c2535fabf316b0cf51afd851db086fd1e3bb970d359

  • SHA512

    4d0f4d1f04813d325d649ac1f442884141a3495138ed6a1317c6b35e0cd425c7c84c6f035ad33a29944db64b1b2ba5b3fd5a4a0d94cc61f020f3fe8fb91c4147

Score
10/10
imminentagilenetpersistencespywaretrojan

Malware Config

Targets

    • Target

      97416074ffe0332f72ec0c2535fabf316b0cf51afd851db086fd1e3bb970d359

    • Size

      725KB

    • MD5

      b5887fc368cc6c6f490b4a8a4d8cc469

    • SHA1

      8092ea17acfe4e885c3317bdbd98d95fd31c6de9

    • SHA256

      97416074ffe0332f72ec0c2535fabf316b0cf51afd851db086fd1e3bb970d359

    • SHA512

      4d0f4d1f04813d325d649ac1f442884141a3495138ed6a1317c6b35e0cd425c7c84c6f035ad33a29944db64b1b2ba5b3fd5a4a0d94cc61f020f3fe8fb91c4147

    Score
    10/10
    imminentagilenetpersistencespywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks