Overview

overview

10

Static

static

1fbb8b79e7...e1.exe

windows7_x64

8

1fbb8b79e7...e1.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1fbb8b79e7971693f6a45fa2ef39ed0fbdbe295c449b4c33a56e4c07b7b529e1

  • Size

    614KB

  • Sample

    220612-vgq7lacfd9

  • MD5

    8c96678b5ce7ce0cb1159933f424c087

  • SHA1

    acba652b4f5e7638e050de070db3a98cd6476627

  • SHA256

    1fbb8b79e7971693f6a45fa2ef39ed0fbdbe295c449b4c33a56e4c07b7b529e1

  • SHA512

    0308fe7bde9d0febca0ab7382cd282a0ff24015a0f97646e22b1b2f6636fcf1180e5855ce806dcdcfc55b6860d9b358492aa844c41ece21f6848f7adb58fe8a0

Score
10/10
imminentagilenetpersistencespywaretrojan

Malware Config

Targets

    • Target

      1fbb8b79e7971693f6a45fa2ef39ed0fbdbe295c449b4c33a56e4c07b7b529e1

    • Size

      614KB

    • MD5

      8c96678b5ce7ce0cb1159933f424c087

    • SHA1

      acba652b4f5e7638e050de070db3a98cd6476627

    • SHA256

      1fbb8b79e7971693f6a45fa2ef39ed0fbdbe295c449b4c33a56e4c07b7b529e1

    • SHA512

      0308fe7bde9d0febca0ab7382cd282a0ff24015a0f97646e22b1b2f6636fcf1180e5855ce806dcdcfc55b6860d9b358492aa844c41ece21f6848f7adb58fe8a0

    Score
    10/10
    agilenetimminentpersistencespywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks