Overview

overview

10

Static

static

4c8ba5a3c6...aa.exe

windows7_x64

10

4c8ba5a3c6...aa.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa

  • Size

    599KB

  • Sample

    220712-gktv1adfgm

  • MD5

    065f6aab9510d8bfe684e12747c4d1ec

  • SHA1

    ca2709e6ad302f1d2d0adc24b961146cc96eadf7

  • SHA256

    4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa

  • SHA512

    db7180393dddd89b4c3310235ffaccbda92356fc0598673804a3a5301a53ec175ca18d96017c5d9a7652a15f95ea6c6e20994eba2e339a3ae653a4c70b36dc97

Score
10/10
imminentpersistencespywaretrojan

Malware Config

Targets

    • Target

      4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa

    • Size

      599KB

    • MD5

      065f6aab9510d8bfe684e12747c4d1ec

    • SHA1

      ca2709e6ad302f1d2d0adc24b961146cc96eadf7

    • SHA256

      4c8ba5a3c65c28dd95cbc5a10b100db5a70338a0c76159b7146141de608ebfaa

    • SHA512

      db7180393dddd89b4c3310235ffaccbda92356fc0598673804a3a5301a53ec175ca18d96017c5d9a7652a15f95ea6c6e20994eba2e339a3ae653a4c70b36dc97

    Score
    10/10
    imminentpersistencespywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks