Overview

overview

10

Static

static

4a4b8fb65c...8a.exe

windows7_x64

10

4a4b8fb65c...8a.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4a4b8fb65ce95d52a666884a16b2943ed65626d87a98b8a21cf55deffcea098a

  • Size

    556KB

  • Sample

    220712-ygjz3agda9

  • MD5

    8a64a6f021d3b839057329de004949ab

  • SHA1

    5ad4c6d3c173562f58bbf17956b21baee919f0c1

  • SHA256

    4a4b8fb65ce95d52a666884a16b2943ed65626d87a98b8a21cf55deffcea098a

  • SHA512

    00e16cd7c8b29e66e8463bdb285192bd25a342134948a195e3f80bcf8f05f3c266b6af5c6cee7d1b904f5066b5062e7e4ce55a534bef4d6e5bdd1e0338b3a672

Score
10/10
imminentspywaretrojan

Malware Config

Targets

    • Target

      4a4b8fb65ce95d52a666884a16b2943ed65626d87a98b8a21cf55deffcea098a

    • Size

      556KB

    • MD5

      8a64a6f021d3b839057329de004949ab

    • SHA1

      5ad4c6d3c173562f58bbf17956b21baee919f0c1

    • SHA256

      4a4b8fb65ce95d52a666884a16b2943ed65626d87a98b8a21cf55deffcea098a

    • SHA512

      00e16cd7c8b29e66e8463bdb285192bd25a342134948a195e3f80bcf8f05f3c266b6af5c6cee7d1b904f5066b5062e7e4ce55a534bef4d6e5bdd1e0338b3a672

    Score
    10/10
    imminentspywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks