Overview

overview

10

Static

static

5

47fec1f5cd...5c.exe

windows7_x64

10

47fec1f5cd...5c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    47fec1f5cde05d36af0e3b7aa906b7a56cf622db151c72dd0dceedc021251c5c

  • Size

    1.2MB

  • Sample

    220714-e934vsdhcr

  • MD5

    9432bbcaab6aaded9550c649c7de5d11

  • SHA1

    1933408859c383ffa40eb82f879f317c4bc3a067

  • SHA256

    47fec1f5cde05d36af0e3b7aa906b7a56cf622db151c72dd0dceedc021251c5c

  • SHA512

    0b974c79d3e13e26b05031bdd6e7990ae93d0854a45674e5edfb00bdafc73600d126acc169f456ef3b6b71ca1f7cd51272017e7576f966470235fa12c5f70fab

Score
10/10
imminentpersistencespywaretrojan

Malware Config

Targets

    • Target

      47fec1f5cde05d36af0e3b7aa906b7a56cf622db151c72dd0dceedc021251c5c

    • Size

      1.2MB

    • MD5

      9432bbcaab6aaded9550c649c7de5d11

    • SHA1

      1933408859c383ffa40eb82f879f317c4bc3a067

    • SHA256

      47fec1f5cde05d36af0e3b7aa906b7a56cf622db151c72dd0dceedc021251c5c

    • SHA512

      0b974c79d3e13e26b05031bdd6e7990ae93d0854a45674e5edfb00bdafc73600d126acc169f456ef3b6b71ca1f7cd51272017e7576f966470235fa12c5f70fab

    Score
    10/10
    imminentpersistencespywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks