Overview

overview

10

Static

static

a4f3f4ffb7...35.exe

windows7-x64

10

a4f3f4ffb7...35.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a4f3f4ffb7e625b76cc509b7c49d98669f0e0f5b3dde5b241d1b30c3d51d0635

  • Size

    452KB

  • Sample

    221125-tc35xshf22

  • MD5

    88140b8a47b523da3f16de466e6ddbd7

  • SHA1

    889dfdd52e48616862f48428e5fcb145d9a88255

  • SHA256

    a4f3f4ffb7e625b76cc509b7c49d98669f0e0f5b3dde5b241d1b30c3d51d0635

  • SHA512

    d6e7fe3dbbf75745ec4da3371051d3b12a0677f8d20b28487b9ba017c19be758d561434ff8b6be1def6984fb5c83646d44f8b9d0ea09e2aa96d5eef6bb399452

  • SSDEEP

    12288:KFhlFYQMvgPhzLuvBszuKmx+Dj3Avzxenf4/41:KrlyQJzLuQu/+/3Yzxenf4g

Score
10/10
imminentpersistencespywaretrojan

Malware Config

Targets

    • Target

      a4f3f4ffb7e625b76cc509b7c49d98669f0e0f5b3dde5b241d1b30c3d51d0635

    • Size

      452KB

    • MD5

      88140b8a47b523da3f16de466e6ddbd7

    • SHA1

      889dfdd52e48616862f48428e5fcb145d9a88255

    • SHA256

      a4f3f4ffb7e625b76cc509b7c49d98669f0e0f5b3dde5b241d1b30c3d51d0635

    • SHA512

      d6e7fe3dbbf75745ec4da3371051d3b12a0677f8d20b28487b9ba017c19be758d561434ff8b6be1def6984fb5c83646d44f8b9d0ea09e2aa96d5eef6bb399452

    • SSDEEP

      12288:KFhlFYQMvgPhzLuvBszuKmx+Dj3Avzxenf4/41:KrlyQJzLuQu/+/3Yzxenf4g

    Score
    10/10
    imminentpersistencespywaretrojan

    • Imminent RAT

      Remote-access trojan based on Imminent Monitor remote admin software.

      trojanspywareimminent

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks