Overview

overview

10

Static

static

1fbe4282fa...74.exe

windows7_x64

10

1fbe4282fa...74.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1fbe4282fac3f6378b2d36518c39cb8e99e5a6b25317e93ce362f16d3fed2c74

  • Size

    637KB

  • Sample

    220612-vfl69agdfm

  • MD5

    bf2ba32ab0d9d73fa0301784d304dbe2

  • SHA1

    a09053ce715e0af5336dbf14e7f997a607efda47

  • SHA256

    1fbe4282fac3f6378b2d36518c39cb8e99e5a6b25317e93ce362f16d3fed2c74

  • SHA512

    0054a61b7a6a4b3f4d0eddfa799ca0ae4307a01e0a1431d1631ecd194fb6d6f4303c339a7744169723911164500f17219002170c5b498446e7e52a0248bfab78

Score
10/10
imminentagilenetpersistencespywaretrojan

Malware Config

Targets

    • Target

      1fbe4282fac3f6378b2d36518c39cb8e99e5a6b25317e93ce362f16d3fed2c74

    • Size

      637KB

    • MD5

      bf2ba32ab0d9d73fa0301784d304dbe2

    • SHA1

      a09053ce715e0af5336dbf14e7f997a607efda47

    • SHA256

      1fbe4282fac3f6378b2d36518c39cb8e99e5a6b25317e93ce362f16d3fed2c74

    • SHA512

      0054a61b7a6a4b3f4d0eddfa799ca0ae4307a01e0a1431d1631ecd194fb6d6f4303c339a7744169723911164500f17219002170c5b498446e7e52a0248bfab78

    Score
    10/10
    imminentagilenetpersistencespywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks